NVIDIA Unified Fabric Manager Enterprise contains a command injection flaw in the IBDiagnet API that can be triggered by an authenticated user with administrative privileges. By sending specially crafted API requests, an attacker can cause the system to execute arbitrary commands, leading to remote code execution, privilege escalation, and unauthorized disclosure of information. This weakness corresponds to CWE-77, reflecting unsanitized command handling.

The vulnerability affects NVIDIA Unified Fabric Manager Enterprise in all supported release streams: the General Availability release, the 2023 LTS release, the 2024 LTS release, and the 2025 LTS release. No specific sub‑version ranges are provided, so the fix applies broadly across these products.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of 3% suggests a low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, indicating no widespread public exploitation currently. Because the flaw requires a user with administrative rights to send API requests, the attack vector is an authenticated attacker with privileged access. Once accessed, code execution and privilege escalation are possible, raising significant risk to confidentiality, integrity, and availability for systems running the affected UFM version.