EUVD-2026-33411
GHSA-f5mf-h7w7-c35x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed SystemLink Dashboard host
-
DeliveryCraft malicious HTTP request
-
ExploitSend request to bypass authentication
-
ExecutionInvoke privileged Dashboard function
-
ImpactExfiltrate data or escalate role
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of NI SystemLink Enterprise Dashboard, requiring only network reachability to the Dashboard's HTTP interface and the ability to send a specially crafted HTTP request. Exploitation is limited by the fact that SystemLink Enterprise is typically deployed inside corporate or lab networks rather than on the public internet, so attackers generally need an internal foothold or VPN access before the vulnerable endpoint is reachable, and only versions 2026-04 and prior are affected. |
| Impact | All available signals point to a high real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) confirms network reachability, low complexity, no required privileges, and no user interaction, with high impact to confidentiality and integrity - characteristics that align with mass-scannable, easily automatable bugs. The 9.3 score is consistent with the description's claim of unauthenticated bypass enabling privilege escalation or information disclosure. EPSS data and SSVC decision values were not provided in the input, and the vulnerability is not listed in CISA KEV at time of analysis, so widespread exploitation is not yet confirmed. No POC has been published, which slightly lowers immediate risk, but the trivial preconditions and the platform's role aggregating sensitive engineering and test data mean SystemLink Enterprise operators should treat this as urgent regardless of current exploitation telemetry. |
| Exploit ScenarioDerived | An attacker who can reach the SystemLink Enterprise Dashboard over the network sends a single specially crafted HTTP request that the application processes without enforcing authentication, returning sensitive data or executing a privileged action on the attacker's behalf. From there, the attacker pivots to enumerate connected test assets, exfiltrate measurement data and configuration, or escalate to an administrative role within the platform. No public exploit has been identified, so the scenario assumes a capable attacker who reverse-engineers the patch or fuzzes the HTTP surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – May 29, 2026
Authentication bypass in NI SystemLink Enterprise Dashboard (versions 2026-04 and prior) allows a remote, unauthenticated attacker to send a crafted HTTP request that circumvents authentication controls, leading to privilege escalation or disclosure of sensitive information. The flaw carries a CVSS 4.0 base score of 9.3 and is network-reachable with low attack complexity and no user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Earlier versions of this analysis (2)
Authentication bypass in NI SystemLink Enterprise Dashboard (versions 2026-04 and prior) allows remote unauthenticated attackers to send a specially crafted HTTP request that circumvents authentication controls, leading to privilege escalation or information disclosure. The CVSS 4.0 base score of 9.3 reflects network-reachable, low-complexity exploitation with no privileges or user interaction required, and high confidentiality and integrity impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Authentication bypass in NI SystemLink Enterprise Dashboard (versions 2026-04 and prior) allows remote unauthenticated attackers to bypass authentication controls via a specially crafted HTTP request, leading to privilege escalation or information disclosure. The CVSS 9.1 score reflects network-reachable, low-complexity exploitation with no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N) and high impact on confidentiality and integrity. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided.
RemediationAI
Apply the fixed release identified in NI's security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/authentication-bypass-vulnerability-in-ni-systemlink-enterprise.html; the input data does not include an exact patched version string, so treat this as patch available per vendor advisory and confirm the target version directly with NI before deployment. Until upgraded, restrict network reachability of the SystemLink Enterprise Dashboard to trusted management subnets via firewall or reverse-proxy ACLs and require VPN access, accepting that this removes broad engineer access from untrusted networks. Place the Dashboard behind an authenticating reverse proxy (for example an SSO-enforcing gateway) so that the vulnerable HTTP endpoints are not directly reachable, noting that this may break clients that bypass the proxy. Increase HTTP access logging and alert on anonymous requests reaching authenticated paths so any exploitation attempts before patching are visible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI SystemLink Enterprise is National Instruments' centralized platform for managing distributed test, measurement, and engineering systems, with a web-based Dashboard used by engineers to monitor instruments, assets, and test data across an organization. The affected component (CPE cpe:2.3:a:ni:systemlink_enterprise:*) exposes an HTTP interface whose authentication layer can be bypassed via a specially crafted request. The root cause maps to CWE-306 (Missing Authentication for a Critical Function), meaning a sensitive endpoint or function fails to verify the requester's identity before processing the request, allowing operations that should be gated by login or role checks to be invoked anonymously.
Know when Systemlink Enterprise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (NI) · only source for this CVE.
CVSS VectorVendor: NI
Lifecycle Timeline
3DescriptionCVE.org
There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Successful exploitation requires an attacker to send a specially crafted HTTP request. This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions.
Executive ViewAI
NI SystemLink Enterprise Dashboard versions 2026-04 and earlier contain a critical authentication bypass vulnerability (CVE-2026-9051, CVSS 9.3) enabling remote attackers to circumvent access controls and gain unauthorized system access with sensitive data disclosure potential. While no public exploit code is currently identified, the critical severity and lack of available patch create immediate risk to organizations running affected versions. Urgent interim protections are required to limit exposure.
Restrict network access via network segmentation and IP-based firewall rules (whitelist only known administrative sources); enable detailed logging of all HTTP requests and authentication attempts with real-time alerting on anomalies; deploy web application firewall rules to detect and block suspicious HTTP request patterns; isolate affected dashboard servers from production data stores and critical systems; establish 24/7 monitoring for unauthorized access attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB