EUVD-2026-65609
GHSA-fp58-r6rm-j2hh
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent vector reflects management-VLAN-only reachability; PR:L required per description; full C/I/A impact from command injection with no scope change beyond UFM host.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
2DescriptionCVE.org
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and information disclosure.
Articles & Coverage 1
AnalysisAI
Code injection in NVIDIA Unified Fabric Manager Enterprise's plugin management API allows low-privileged, adjacent-network authenticated users to execute arbitrary commands on the UFM host by submitting a specially crafted API request. All current release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per vendor-supplied CPE data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The plugin management API endpoint must be network-reachable from the attacker's position, requiring adjacency to the UFM management network segment (AV:A - same VLAN, broadcast domain, or directly connected management interface). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 score reflects high impact across all three pillars (C:H/I:H/A:H), but two factors meaningfully constrain real-world exploitability: the Adjacent attack vector (AV:A) and the low-privilege authentication requirement (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the vendor-released patch for the applicable UFM Enterprise release track (GA, LTS 2023, LTS 2024, or LTS 2025). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all NVIDIA Unified Fabric Manager Enterprise deployments by version and release track (GA, LTS 2023, LTS 2024, LTS 2025), document network-accessible UFM hosts, and identify dependent HPC/AI infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in NVIDIA UFM Enterprise's web interface authorization component allows an attacker on the adjacen
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level ne
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today