CVE-2026-24167: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in NVIDIA Unified Fabric Manager Enterprise - GA

CVE-2026-24167 is a command injection vulnerability (CWE-77) in NVIDIA Unified Fabric Manager Enterprise - GA's user management component. It allows an authenticated administrator to inject commands via crafted API requests. Successful exploitation could result in code execution, escalation of privileges, and disclosure of sensitive information. The CVSS 3.1 base score is 6.8, with attack vector requiring adjacent network access, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Exploitation of this vulnerability could allow an authenticated administrator to execute arbitrary commands on the affected system, potentially leading to full system compromise including privilege escalation and unauthorized information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor NVIDIA's advisories for updates and avoid exposing the management interface to untrusted networks. Restrict administrative access to trusted personnel only.