CVE-2026-24168: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in NVIDIA Unified Fabric Manager Enterprise - GA

CVE-2026-24168 is a command injection vulnerability (CWE-77) in NVIDIA Unified Fabric Manager Enterprise - GA's IBDiagnet API. It allows an authenticated attacker with administrative privileges to execute arbitrary commands by sending specially crafted API requests. This can lead to code execution, escalation of privileges, and disclosure of sensitive information. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.8 (AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No vendor advisory or patch information is currently available.

An attacker with administrative privileges can exploit this vulnerability to execute arbitrary commands on the affected system, potentially leading to full system compromise including privilege escalation and sensitive information disclosure. The attack requires authentication and administrative rights, which limits exposure to privileged users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to the IBDiagnet API.