CVE-2026-4130

Storage of Sensitive Information in Cleartext in NI SystemLink

Published Sep 10, 2026 CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Description

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

Analysis

Technical impact

NI SystemLink and its Server component store sensitive credentials or tokens in cleartext, allowing a local attacker to read and expose these unencrypted secrets. The flaw directly compromises confidentiality and is classified as CWE‑312. The vulnerability affects all releases prior to 2026 Q3.

Affected Systems

The flaw exists in NI SystemLink and NI SystemLink Server in all releases prior to 2026 Q3. All earlier versions before 2026 Q3 are affected.

Risk and Exploitability

The CVSS score of 8.4 classifies this as a high‑severity flaw. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the local‑access requirement means that insiders or compromised local accounts can readily exploit the defect. Once local privileges are achieved, reading the cleartext store is straightforward, with no additional network or privilege escalation steps required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

SystemLink

unaffected

Version	Status	Constraints
`0`	affected	< 26.5.0

SystemLink Server

unaffected

Version	Status	Constraints
`0`	affected	< 26.5.0

No data.

Vendor Product Versions

Systemlink

Version	Status	Scheme	Platform
`[0,26.5.0]`	affected	semver	—

Systemlink Server

Version	Status	Scheme	Platform
`[0,26.5.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest update from NI that eliminates cleartext storage of sensitive data
Where a patch is not yet available, configure the system to store credentials or tokens in encrypted form, following NI guidance
Enforce strict local access controls and apply least privilege principles for users interacting with the system

Generated by OpenCVE AI on September 21, 2026 at 05:18 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.105% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html

History

Sep 16, 2026 4:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.	There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

Sep 10, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 10, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.
Title		Storage of Sensitive Information in Cleartext in NI SystemLink
First Time appeared		Ni Ni systemlink Ni systemlink Server
Weaknesses		CWE-312
CPEs		cpe:2.3:a:ni:systemlink:::::::: cpe:2.3:a:ni:systemlink_server::::::::
Vendors & Products		Ni Ni systemlink Ni systemlink Server
References		https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 8.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`