NI grpc-device EUVD-2026-38027

Patch available per vendor advisory: upgrade NI grpc-device to the fixed release published in GHSA-7vg9-5c74-289x (https://github.com/ni/grpc-device/security/advisories/GHSA-7vg9-5c74-289x) and apply the corresponding NI InstrumentStudio update referenced in the NI security bulletin (https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html); the specific patched version string is not enumerated in the provided data, so confirm the exact build from those advisories before deployment. Until patched, restrict network reachability of the grpc-device listener to trusted hosts via host firewall or network ACLs and place the service behind a VPN or jumphost (trade-off: legitimate remote test stations must be reconfigured to the new access path), and avoid exposing the data moniker endpoint to shared lab networks. Monitor the grpc-device process for unexpected restarts as a detection signal and configure a process supervisor to auto-restart the service so a single crash does not produce extended outage, accepting that auto-restart masks repeated abuse and should be paired with logging.