CVE-2026-24170
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Risk Assessment
The risk for the organization includes the possibility of an authenticated user gaining control over the system, potentially leading to data integrity and confidentiality breaches.
Recommendation
It is recommended to apply NVIDIA-provided patches immediately and restrict access to the web interface to trusted users only.
Other vulnerabilities in NVIDIA UFM Enterprise
See all- CVE-2026-24169High
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
- CVE-2026-24168Medium
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection via crafted API requests. Successful exploitation may lead to code execution, privilege escalation, and information disclosure.
- CVE-2026-24167Medium
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands via a crafted API request. Successful exploitation might lead to code execution, privilege escalation, and information disclosure.
- CVE-2026-24166Medium
NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. Successful exploitation might lead to information disclosure and privilege escalation.
Original NVD description (English source)
NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.