NI SystemLink CVE-2026-4129

Exploitation requires a valid NI SystemLink user account with limited (low) privileges - unauthenticated access is not possible per the CVSS 4.0 PR:L metric. The SystemLink server must be network-reachable from the attacker, which is the typical deployment configuration. No non-default feature, protocol, or configuration setting is required; the flaw affects standard installations at or before version 26.5.0. Exploitation is bounded by the requirement to hold any SystemLink account credential: organizations that tightly control user account provisioning, enforce multi-factor authentication, or isolate SystemLink to air-gapped networks significantly reduce real-world risk.

The vendor-assigned CVSS 4.0 score of 8.6 (High) reflects a network-reachable, low-complexity flaw exploitable by any authenticated low-privilege account. The VC:H and VI:H metrics indicate both high confidentiality and integrity impact on the vulnerable system, though the description explicitly references only 'access' to files and directories - the integrity (VI:H) component implies write capability but is not explicitly confirmed in the description text and should be independently verified against the vendor advisory. No EPSS data is provided in the input, and the vulnerability is absent from CISA KEV, indicating no observed active exploitation at time of analysis. Despite the high CVSS score, the limited production footprint of NI SystemLink in industrial test environments constrains the overall attack surface. For organizations running SystemLink in multi-user network configurations - particularly shared lab or manufacturing environments - the risk is material: any low-privilege account could potentially exfiltrate host configuration, credentials, or sensitive operational data from the underlying OS.

An attacker with a valid low-privilege NI SystemLink account - obtained via credential theft, default credentials, or account registration if allowed - submits crafted API or file-access requests referencing restricted host OS file paths, such as credential stores or configuration directories. The application's missing authorization check fails to block these requests, and the attacker reads (and potentially writes) files outside the intended application boundary. No public proof-of-concept exists at time of analysis, but the straightforward nature of a path-traversal-style authorization bypass makes independent discovery feasible.