NVIDIA UFM Enterprise IBDiagnet API Command Injection (CVE-2026-24168)
CVE-2026-24168 Published on August 25, 2026
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and information disclosure.
Vulnerability Analysis
Weakness Type
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2026-24168 has been classified to as a Command Injection vulnerability or weakness.
Affected Versions
NVIDIA Unified Fabric Manager Enterprise - GA:- Version All GA versions prior to 6.24.1-5 is affected.
- Version All LTS versions prior to 6.23.20-3 is affected.
- Version All LTS versions prior to 6.19.15 is affected.
- Version All LTS versions prior to 6.15.17 is affected.