NVIDIA UFM Enterprise CVE-2026-24169

The plugin management API endpoint must be network-reachable from the attacker's position, requiring adjacency to the UFM management network segment (AV:A - same VLAN, broadcast domain, or directly connected management interface). The attacker must possess valid UFM Enterprise credentials at a low-privilege level (PR:L); unauthenticated access is not sufficient. No user interaction on the server side is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions, timing dependencies, or special environmental states are needed beyond the above. Exploitation is bounded by: the adjacent-network requirement (not reachable from the internet in a properly firewalled deployment), the need for at least low-privilege authentication to the UFM API, and UFM's niche deployment in InfiniBand-connected HPC and AI environments. Organizations that restrict the plugin management API to administrator accounts only and enforce management VLAN isolation eliminate or significantly reduce the practical attack surface.

The CVSS 8.0 score reflects high impact across all three pillars (C:H/I:H/A:H), but two factors meaningfully constrain real-world exploitability: the Adjacent attack vector (AV:A) and the low-privilege authentication requirement (PR:L). AV:A limits exposure to actors who are already on the same network segment or management VLAN as the UFM appliance - internet-based attackers cannot reach this directly in a properly segmented environment. PR:L requires the attacker to first obtain valid credentials, even at a low permission level; unauthenticated exploitation is not possible per the CVSS vector. EPSS data is absent from the provided intelligence, and no CISA KEV listing or public POC has been identified, so exploitation appears theoretical at present. The realistic threat actor is an insider, a compromised service account, or an attacker who has already penetrated the management plane. Given UFM's role in orchestrating InfiniBand fabric - which underpins GPU cluster interconnects in AI/HPC environments - a successful compromise could cascade into cluster-wide availability disruption or credential exfiltration. The adjacent-network restriction is load-bearing: organizations that enforce strict management-plane segmentation and least-privilege API access significantly reduce realistic risk despite the high CVSS base score.

An attacker who has obtained low-privileged UFM Enterprise credentials - through phishing, credential stuffing against a management host, or insider access - connects from within the management VLAN and issues a crafted HTTP API request to the plugin management endpoint, embedding shell metacharacters or command separators in a plugin name or configuration parameter. The UFM application passes the unsanitized input to a system command without escaping, resulting in execution of attacker-supplied commands under the UFM process context. The attacker then leverages this execution to escalate to root, exfiltrate fabric topology maps and stored credentials, or corrupt fabric configuration - disrupting the InfiniBand interconnect for dependent GPU compute nodes. No public POC has been identified, but CWE-77 injection patterns are well-understood and the API surface is documented.