UFM Enterprise CVE-2026-24170

Exploitation requires network adjacency to the UFM Enterprise web management interface - the attacker must be on the same Layer-2 or closely adjacent network segment as the management host, consistent with CVSS AV:A. The CVSS vector specifies PR:N (no prior privileges required), but the description states 'an authenticated user' as the actor, creating an unresolved ambiguity: it is not confirmed from available data whether exploitation requires any valid credential or is fully unauthenticated. No user interaction is required (UI:N). The vulnerability is limited to the web interface authorization component; other UFM interfaces or protocols are not implicated by available data. Exploitation is further constrained to environments where the UFM web interface is network-accessible from an attacker-reachable segment - organizations with strict out-of-band management network isolation reduce exposure significantly.

The CVSS 3.1 base score of 8.8 (High) is driven by High impact across all three CIA pillars and is partially constrained by AV:A (Adjacent network), which limits exploitation to attackers with foothold or physical presence on the same network segment as the UFM management interface. This adjacency requirement is the primary real-world risk moderator and meaningful in practice, as UFM typically sits on dedicated out-of-band management networks - though in poorly segmented HPC environments the management plane may be reachable by a wider population. There is a notable discrepancy between the CVSS vector (PR:N - no privileges required) and the CVE description, which states 'an authenticated user could cause improper authentication.' This could mean the vulnerability is a full authentication bypass exploitable without any prior credentials (consistent with PR:N), or it could mean a low-privileged authenticated user can escalate, with the PR:N assignment being a vendor interpretation of the effective post-bypass state. This ambiguity should be resolved against the NVIDIA advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5809 before finalizing remediation priority. No EPSS score was provided in the source data, and the CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. AC:L suggests exploitation is straightforward once network adjacency is achieved, so even a small or mid-sized operation running InfiniBand clusters should treat this as urgent if the management network is not strictly isolated.

An attacker with access to the network segment hosting the UFM Enterprise management interface crafts a malformed or manipulated HTTP request targeting the web authorization component. The improper authentication logic (CWE-287) fails to correctly validate the request's credentials or authorization context, granting the attacker elevated access. The attacker then leverages this elevated session to execute arbitrary code on the UFM host, potentially pivoting to control the entire InfiniBand fabric management plane.