CVE-2026-24169

HighCVSS 8.0/10Last modified Aug 28, 2026

Description

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
NVIDIAUnified Fabric Manager Enterprise - GAAll GA versions prior to 6.24.1-5
NVIDIAUnified Fabric Manager Enterprise - LTS 2025All LTS versions prior to 6.23.20-3
NVIDIAUnified Fabric Manager Enterprise - LTS 2024All LTS versions prior to 6.19.15
NVIDIAUnified Fabric Manager Enterprise - LTS 2023All LTS versions prior to 6.15.17

References

Timeline

Published
Aug 25, 2026
Last modified
Aug 28, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-24179.3A Missing Authentication for Critical Function vulnerability in Pharos Controls Mosaic Show Controller firmware version 2.15.3 could allow aCVE-2026-241708.8NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeCVE-2026-241737.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241747.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request to the sCVE-2026-241757.5NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header tCVE-2026-241764.3NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. ACVE-2026-241777.7NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of thCVE-2026-241789.8NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cauCVE-2026-24189.1The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauCVE-2026-241807.3NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of thisCVE-2026-241817.3NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of thisCVE-2026-241826.5NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker could leak held driver locks. A successful exploit of
CVE-2026-24169: High severity, CVSS 8.0 | Vulnix