Description
NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Published: 2026-08-25
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NVIDIA Unified Fabric Manager Enterprise’s web interface includes an improper authentication flaw that allows an authenticated user to send specially crafted HTTP requests, leading the system to grant elevated privileges or execute arbitrary code. The flaw is classified as CWE-287, an improper authentication vulnerability, and offers a pathway for attackers to compromise the managed fabric environment.

Affected Systems

The vulnerability affects NVIDIA Unified Fabric Manager Enterprise for all supported releases: the General Availability (GA) build and the LTS 2023, LTS 2024, and LTS 2025 editions.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. Although the EPSS score is not available, the flaw requires pre‑authenticated access, meaning it is most relevant to insiders or attackers who have obtained user credentials. Because exploitation can result in code execution, the risk is significant. The vulnerability is not currently listed in the CISA KEV catalog, but its high impact warrants prompt attention. Attackers would likely target the web interface and send crafted requests to trigger the improper authentication.

Generated by OpenCVE AI on August 25, 2026 at 17:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any NVIDIA Unified Fabric Manager Enterprise update that fixes the improper authentication issue.
  • If an update is unavailable, disable public access to the UFM web interface or restrict it to a trusted network segment.
  • Implement strict monitoring of authentication logs for anomalous HTTP requests and enforce rate limiting on login endpoints.
  • Consider deploying a web application firewall that detects and blocks malformed HTTP requests targeting the UFM web interface.

Generated by OpenCVE AI on August 25, 2026 at 17:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Improper Authorization in NVIDIA UFM Enterprise Web Interface Allows Privilege Escalation

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-08-25T16:17:41.935Z

Reserved: 2026-01-21T19:09:30.919Z

Link: CVE-2026-24170

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T17:17:10.290

Modified: 2026-08-25T17:17:10.290

Link: CVE-2026-24170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T17:30:07Z

Weaknesses