What is the CVSS score of CVE-2026-37452?

CVE-2026-37452 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of MSI NBFoundation are affected by CVE-2026-37452?

A vulnerability in MSI's NBFoundation Service (version 2.0.2506.1201) could expose credentials and sensitive data on MSI notebooks across your infrastructure.

How to fix or mitigate CVE-2026-37452?

Within 24 hours, identify and inventory all MSI devices running NBFoundation Service version 2.0.2506.1201 using endpoint detection tools or MDM systems. Within 7 days, implement network segmentation to restrict remote access to the vulnerable MSIAPService.exe component and disable the service on non-production systems if operationally feasible. Within 30 days, establish a patch monitoring process with MSI for a vendor release and develop a deployment plan for immediate rollout once available; engage MSI support if the vulnerable version cannot be updated or disabled.

MSI NBFoundation CVE-2026-37452

HIGH

Information Exposure (CWE-200)

2026-06-25 mitre

Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Retained AV:N/PR:N/UI:N per stated vector for an unauthenticated info leak with high confidentiality only (I:N/A:N), though AV could be local given the insecure-permissions service root cause.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:17 vuln.today

CVE Published

Jun 25, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Jun 25, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSIAPService.exe component

AnalysisAI

Information disclosure in MSI's NBFoundation Service version 2.0.2506.1201 lets a remote attacker read sensitive data exposed by the bundled MSIAPService.exe component due to insecure permissions (CWE-200). Publicly available exploit code exists (GitHub, LittleSuRii/CVE-2026-MSIAPService), but there is no public evidence of active exploitation and the EPSS score is low at 0.22% (13th percentile). Rated CVSS 7.5 for a high-confidentiality, no-integrity, no-availability impact against MSI notebook systems running the affected service.

Technical ContextAI

NBFoundation is MSI's notebook support/foundation service that runs as a background Windows service (MSIAPService.exe) on MSI laptops to provide system utility and telemetry functions. The root cause is classed as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from insecure permissions on the MSIAPService.exe component - meaning the service exposes data or an interface without adequately restricting who can access it. The CPE data is non-informative (cpe:2.3:a:n/a:n/a:*), so the exact affected product must be taken from the description (MSI NBFoundation Service v.2.0.2506.1201) rather than from structured NVD product data.

RemediationAI

Consult MSI's product security advisories at https://csr.msi.com/global/product-security-advisories for the fixed release, as no vendor-released patch version is identified in the available data at time of analysis - do not deploy an unverified version number. As specific compensating controls until a confirmed fix is applied: stop and disable the NBFoundation service (MSIAPService.exe) on systems where the MSI notebook utility features are not needed, accepting the trade-off of losing associated MSI support/telemetry functionality; restrict host-based firewall rules to block any network listener exposed by MSIAPService.exe if the service must remain running, which may break legitimate MSI companion-app communication; and tighten NTFS/service ACLs on the component to remove overly permissive access. Because this is a vendor-bundled consumer utility, uninstalling the NBFoundation package entirely is a viable option on managed fleets where it is unnecessary.