EUVD-2026-65608
GHSA-gc4x-3qrf-jj7m
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description says 'authenticated user,' so PR:L is more accurate than vendor's PR:N; AV:A and full CIA impact retained.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.
Articles & Coverage 1
AnalysisAI
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacent network to send specially crafted HTTP requests that circumvent authentication checks, yielding code execution and privilege escalation on the UFM management host. All four active release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are listed as affected per NVD CPE data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the UFM Enterprise web management interface - the attacker must be on the same Layer-2 or closely adjacent network segment as the management host, consistent with CVSS AV:A. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 (High) is driven by High impact across all three CIA pillars and is partially constrained by AV:A (Adjacent network), which limits exploitation to attackers with foothold or physical presence on the same network segment as the UFM management interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation action is to apply the vendor-released patch referenced in the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5809; exact fixed version numbers must be retrieved from that advisory, as they are not confirmed in the available NVD data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all NVIDIA UFM Enterprise instances running GA, LTS 2023, LTS 2024, or LTS 2025 releases; restrict administrative access to the UFM web interface to trusted IP ranges only; enable detailed logging of all web interface transactions and monitor for suspicious HTTP patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-netwo
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level ne
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today