EUVD-2026-75564
GHSA-f777-xf39-r6fm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable by low-privilege account (PR:L); no user interaction; C:H/I:H consistent with vendor CVSS 4.0 VC:H/VI:H; no availability impact indicated; scope unchanged as impact is on the host itself.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
6DescriptionCVE.org
There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.
AnalysisAI
Improper access control in NI SystemLink and NI SystemLink Server (all versions through 26.5.0, 2026 Q3) allows a network-authenticated user with limited privileges to access host operating system files and directories that should be restricted. The root cause is CWE-862 (Missing Authorization) - the application authenticates the user but fails to enforce authorization boundaries between SystemLink application scope and the underlying host OS file system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid NI SystemLink user account with limited (low) privileges - unauthenticated access is not possible per the CVSS 4.0 PR:L metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 4.0 score of 8.6 (High) reflects a network-reachable, low-complexity flaw exploitable by any authenticated low-privilege account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the NI security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/improper-access-controls-in-ni-systemlink.html to obtain and apply the vendor-released patch; the EUVD lists all releases through 26.5.0 as affected, so the fix is expected in a release beyond 26.5.0, but the exact patched version number must be confirmed from the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running NI SystemLink versions through 26.5.0 and assess what sensitive data resides in OS directories accessible via this flaw; implement network-level restrictions to limit NI SystemLink server access to authorized administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Systemlink
View allCleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.
An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Ra
An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may r
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today