Description
NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Published: 2026-08-25
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation with Possible Code Execution
Action: Immediate Patch
AI Analysis

Impact

NVIDIA Unified Fabric Manager Enterprise’s web interface includes an improper authentication flaw that allows an authenticated user to send specially crafted HTTP requests, which can cause the system to grant elevated privileges or execute arbitrary code. The vulnerability is categorized as CWE-287, an improper authentication weakness, and provides a direct attack path for compromise of the fabric environment.

Affected Systems

The vulnerability affects NVIDIA Unified Fabric Manager Enterprise for all supported releases: the General Availability (GA) build and the LTS 2023, LTS 2024, and LTS 2025 editions.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. Although the EPSS score is not available, the flaw requires pre‑authenticated access, meaning it is most relevant to insiders or attackers who have obtained user credentials. Because exploitation can result in code execution, the risk is significant. The vulnerability is not currently listed in the CISA KEV catalog, but its high impact warrants prompt attention. Attackers would likely target the web interface and send crafted requests to trigger the improper authentication.

Generated by OpenCVE AI on August 25, 2026 at 21:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any NVIDIA Unified Fabric Manager Enterprise update that fixes the improper authentication issue.
  • If an update is unavailable, disable public access to the UFM web interface or restrict it to a trusted network segment.
  • Implement strict monitoring of authentication logs for anomalous HTTP requests and enforce rate limiting on login endpoints.
  • Consider deploying a web application firewall that detects and blocks malformed HTTP requests targeting the UFM web interface.

Generated by OpenCVE AI on August 25, 2026 at 21:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Nvidia
Nvidia unified Fabric Manager Enterprise - Ga
Nvidia unified Fabric Manager Enterprise - Lts 2023
Nvidia unified Fabric Manager Enterprise - Lts 2024
Nvidia unified Fabric Manager Enterprise - Lts 2025
Vendors & Products Nvidia
Nvidia unified Fabric Manager Enterprise - Ga
Nvidia unified Fabric Manager Enterprise - Lts 2023
Nvidia unified Fabric Manager Enterprise - Lts 2024
Nvidia unified Fabric Manager Enterprise - Lts 2025

Tue, 25 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Title Improper Authentication in NVIDIA Unified Fabric Manager Web Interface Enables Privilege Escalation

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Title Improper Authentication in NVIDIA Unified Fabric Manager Web Interface Enables Privilege Escalation

Tue, 25 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Improper Authorization in NVIDIA UFM Enterprise Web Interface Allows Privilege Escalation

Tue, 25 Aug 2026 17:45:00 +0000

Type Values Removed Values Added
Title Improper Authorization in NVIDIA UFM Enterprise Web Interface Allows Privilege Escalation

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Nvidia Unified Fabric Manager Enterprise - Ga Unified Fabric Manager Enterprise - Lts 2023 Unified Fabric Manager Enterprise - Lts 2024 Unified Fabric Manager Enterprise - Lts 2025
cve-icon MITRE

Status: PUBLISHED

Assigner: nvidia

Published:

Updated: 2026-08-25T19:38:16.810Z

Reserved: 2026-01-21T19:09:30.919Z

Link: CVE-2026-24170

cve-icon Vulnrichment

Updated: 2026-08-25T19:38:11.435Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-25T17:17:10.290

Modified: 2026-08-28T19:46:29.323

Link: CVE-2026-24170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:36:52Z

Weaknesses