EUVD-2026-65610
GHSA-p66p-j5f7-j4r6
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AV:A reflects management API confined to adjacent network; PR:H confirmed by admin-only exploitation per description; all impacts High given OS-level command injection with full C/I/A exposure.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
AnalysisAI
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two explicit, confirmed prerequisites: (1) the attacker must hold valid UFM Enterprise administrator credentials - the CVSS PR:H metric confirms that high-privilege authentication is mandatory and cannot be bypassed; (2) the attacker must have adjacent network access to the UFM management API (AV:A), meaning the attack cannot originate from the public internet and requires access to the same network segment or management VLAN hosting the UFM service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.8 (Medium) is primarily held down by the high-privilege requirement (PR:H) and adjacent network constraint (AV:A), which together substantially restrict the realistic attacker pool to insiders, compromised admin accounts, or attackers with an established foothold in the management network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5809 for patched versions across all four affected release tracks (GA, LTS 2023, LTS 2024, LTS 2025); specific fixed version numbers were not present in the available intelligence and must be confirmed directly from the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacen
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-netwo
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level ne
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today