NVIDIA UFM Enterprise CVE-2026-24167

Exploitation requires two explicit, confirmed prerequisites: (1) the attacker must hold valid UFM Enterprise administrator credentials - the CVSS PR:H metric confirms that high-privilege authentication is mandatory and cannot be bypassed; (2) the attacker must have adjacent network access to the UFM management API (AV:A), meaning the attack cannot originate from the public internet and requires access to the same network segment or management VLAN hosting the UFM service. The vulnerability is triggered through the user management API endpoint and does not appear to require any non-default configuration - any deployed UFM Enterprise instance with its management interface accessible is theoretically vulnerable once credentials are obtained. Exploitation is meaningfully limited by the admin credential requirement, which restricts the realistic threat actor to malicious insiders, attackers who have previously compromised an administrator's account, or adversaries who have already established a foothold within the management network segment.

The CVSS base score of 6.8 (Medium) is primarily held down by the high-privilege requirement (PR:H) and adjacent network constraint (AV:A), which together substantially restrict the realistic attacker pool to insiders, compromised admin accounts, or attackers with an established foothold in the management network. Despite the Medium composite score, all three impact dimensions are rated High (C:H/I:H/A:H), meaning a successful exploit is fully destructive within the affected system's scope - full confidentiality, integrity, and availability loss on the UFM host. No EPSS score was provided in the available intelligence, so exploitation probability cannot be quantified. Neither CISA KEV listing nor a public proof-of-concept has been identified, and SSVC exploitation status is 'None' based on current data. In multi-tenant HPC or AI cluster environments where UFM administrator access is shared among multiple operators, or where insider threat is a concern, this vulnerability carries elevated practical risk despite its moderate CVSS score. The low attack complexity (AC:L) means exploitation requires no special timing or race condition - credentials and adjacency are the only barriers.

An attacker who has obtained UFM Enterprise administrator credentials - via phishing, credential reuse, or insider access - connects to the UFM management API from within the adjacent management network and submits a crafted API request to the user management endpoint with shell metacharacters or command sequences embedded in a parameter value. The UFM service constructs an OS command incorporating the unsanitized input and executes it with the process's privileges, granting the attacker arbitrary code execution on the UFM host. From this position, the attacker can escalate to OS-level root, pivot to connected InfiniBand fabric nodes, or exfiltrate topology and credential data stored by the management platform.