NVIDIA Unified Fabric Manager Enterprise contains a command injection flaw in the IBDiagnet API that can be triggered by an authenticated user with administrative privileges. By sending specially crafted API requests, an attacker can cause the system to execute arbitrary commands, which may lead to remote code execution, privilege escalation, and unauthorized disclosure of information. The weakness corresponds to CWE-77, reflecting unsanitized command handling.

The vulnerability affects NVIDIA Unified Fabric Manager Enterprise in all supported release streams: the General Availability release, the 2023 LTS release, the 2024 LTS release, and the 2025 LTS release. No specific sub‑version ranges are provided, so the fix applies broadly across these products.

The CVSS score of 6.8 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploitation yet. Because the flaw requires a user with administrative rights to send API requests, the attack vector is an authenticated attacker with privileged access. Once accessed, code execution and privilege escalation are possible, raising significant risk to confidentiality, integrity, and availability for systems running the affected UFM version.