CVE-2026-24166: CWE-321 Use of Hard-coded Cryptographic Key in NVIDIA Unified Fabric Manager Enterprise - GA

CVE-2026-24166 describes a vulnerability in NVIDIA Unified Fabric Manager Enterprise - GA where a hard-coded cryptographic key is used within the session management component. This weakness could be exploited by an attacker to extract information, resulting in information disclosure and escalation of privileges. The CVSS 3.1 base score is 5.1, reflecting a local attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. No vendor advisory or patch information is provided.

An attacker exploiting this vulnerability could gain access to sensitive information protected by the hard-coded cryptographic key, leading to information disclosure. Additionally, the attacker might escalate privileges within the system. The attack requires local access and is of high complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Until a patch is released, limit local access to trusted users and monitor for suspicious activity related to session management components.