CVE-2026-24168

MediumCVSS 6.8/10Last modified Aug 28, 2026

Description

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and information disclosure.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIAUnified Fabric Manager Enterprise - GAAll GA versions prior to 6.24.1-5
NVIDIAUnified Fabric Manager Enterprise - LTS 2025All LTS versions prior to 6.23.20-3
NVIDIAUnified Fabric Manager Enterprise - LTS 2024All LTS versions prior to 6.19.15
NVIDIAUnified Fabric Manager Enterprise - LTS 2023All LTS versions prior to 6.15.17

References

Timeline

Published
Aug 25, 2026
Last modified
Aug 28, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-241698.0NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject coCVE-2026-24179.3A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow aCVE-2026-241708.8NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeCVE-2026-241737.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241747.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241757.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tCVE-2026-241764.3NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. ACVE-2026-241777.7NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of thCVE-2026-241789.8NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cauCVE-2026-24189.1The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauCVE-2026-241807.3NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of thisCVE-2026-241817.3NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this