VulnerabilityUndergoing Analysis

CVE-2026-24166

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information.

MEDIUM 5.1EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges.

CVSS 3.1: 5.1 MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-321
Source: psirt@nvidia.com

References

https://github.com/NVIDIA/product-security/tree/main/2026/5809
https://nvd.nist.gov/vuln/detail/CVE-2026-24166
https://www.cve.org/CVERecord?id=CVE-2026-24166

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.