NVIDIA UFM Enterprise API command injection (CVE-2026-24167)
CVE-2026-24167 Published on August 25, 2026
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
Vulnerability Analysis
Weakness Type
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2026-24167 has been classified to as a Command Injection vulnerability or weakness.
Affected Versions
NVIDIA Unified Fabric Manager Enterprise - GA:- Version All GA versions prior to 6.24.1-5 is affected.
- Version All LTS versions prior to 6.23.20-3 is affected.
- Version All LTS versions prior to 6.19.15 is affected.
- Version All LTS versions prior to 6.15.17 is affected.