NVIDIA Releases Security Fixes for UFM Enterprise and DGX Spark

TL;DR

NVIDIA has published crucial NVIDIA security updates to address multiple vulnerabilities across its enterprise portfolio. These security flaws impact NVIDIA Unified Fabric Manager Enterprise and DGX Spark systems. Administrators should apply the official patches immediately to protect their high-performance computing infrastructure.

Notable CVEs

Why the Vulnerabilities Matter

The newly disclosed security flaws carry serious risks for enterprise environments. The highest-rated flaw in UFM Enterprise, CVE-2026-24170, earns a CVSS base score of 8.8. According to the advisory, “a successful exploit of this vulnerability might lead to code execution and escalation of privileges.” High-performance networks depend on UFM to manage InfiniBand infrastructure. Therefore, an exploit could compromise vital datacenter operations.

Similarly, the DGX Spark vulnerabilities allow attackers to execute arbitrary code within system firmware. As NVIDIA notes, “The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems.” Organizations running artificial intelligence workloads face significant threats of data tampering and service disruption. Neither NVIDIA nor independent researchers have confirmed active exploitation in the wild. Furthermore, public proof-of-concept exploits do not currently exist. NVIDIA has not published estimates for affected installation counts.

How the Attacks Work

Attackers can exploit these flaws through distinct mechanisms across both platforms.

UFM Enterprise Vulnerabilities

In UFM Enterprise, attackers target several API endpoints and web components. For CVE-2026-24170, the advisory states that “NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests.” Additionally, CVE-2026-24169 involves the plugin management API. An authenticated attacker sends crafted API requests to inject code. Meanwhile, CVE-2026-24167 and CVE-2026-24168 involve improper input handling in user management and diagnostic tools. Finally, CVE-2026-24166 stems from a hard-coded cryptographic key in session management.

DGX Spark Firmware Flaws

The DGX Spark issues reside primarily in UEFI and system firmware. Both CVE-2026-24262 and CVE-2026-47626 involve out-of-bounds write conditions. A local attacker with administrative access triggers memory corruption. Consequently, this flaw enables code execution and data tampering. Furthermore, CVE-2026-24263 triggers a NULL pointer dereference in firmware routines. Another flaw, CVE-2026-47624, allows a local privileged user to bypass administrator password protection in UEFI.

Affected Versions

The UFM Enterprise vulnerabilities affect all General Availability (GA) versions prior to 6.24.1-5. They also impact LTS 2025 releases prior to 6.23.20-3, LTS 2024 releases prior to 6.19.15, and LTS 2023 versions prior to 6.15.17.

For DGX Spark, the firmware flaws affect UEFI versions 0 through 1.110.12.

Patch and Mitigation Steps

Organizations must apply the critical NVIDIA security updates directly to all vulnerable appliances. Administrators should upgrade UFM Enterprise to version 6.24.1-5 or higher from the Application Hub. Users on LTS tracks must upgrade to versions 6.23.20-3, 6.19.15, or 6.15.17 respectively. You can review full release details in the official NVIDIA UFM security bulletin.

For DGX Spark systems, operators should update UEFI to version 1.110.13. For step-by-step instructions, administrators should consult the NVIDIA DGX Spark security update notice. Applying these updates eliminates the vulnerabilities across all affected components.

Support Our Threat Intelligence

Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.