EUVD-2026-65611
GHSA-jggj-fm67-3qgj
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adjacent vector and high privilege requirement match admin-authenticated API access on a segmented management network; full C/I/A impact reflects arbitrary command execution potential with no scope change to other systems.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A successful exploit of this vulnerability may lead to code execution, escalation of privileges and information disclosure.
AnalysisAI
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must all be satisfied: (1) Valid NVIDIA UFM Enterprise administrative credentials - the CVSS PR:H metric explicitly confirms that high-privilege authentication is mandatory; this is not inferred from description text alone. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 reflects a meaningful reduction from the high C/I/A impact due to two compounding barriers: administrative authentication (PR:H) and network adjacency (AV:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NVIDIA product security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5809 for patched versions specific to each release train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacen
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-netwo
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today