This vulnerability (CVE-2026-4129) in NI SystemLink involves missing authorization controls (CWE-862), permitting authenticated users with limited privileges to access restricted host OS files and directories. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality and integrity impact but no availability impact. The affected products are NI SystemLink and NI SystemLink Server versions 2026 Q3 and earlier. No vendor advisory or patch information is currently provided.

An attacker with valid credentials but limited privileges can bypass intended access restrictions to read and modify sensitive host operating system files and directories. This can lead to unauthorized disclosure and alteration of critical data, potentially compromising system integrity and confidentiality. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to file access. Follow vendor guidance once published.