{"id":"CVE-2026-9051","state":"PUBLISHED","title":"Authentication Bypass Vulnerability in NI SystemLink Enterprise","description":"There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure.  Successful exploitation requires an attacker to send a specially crafted HTTP request.  This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions.","publishedAt":"2026-05-29T18:04:48.703Z","updatedAt":"2026-05-29T18:45:55.475Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"NI"},"assigner":"NI","products":["NI SystemLink Enterprise"],"affected":[{"vendor":"NI","product":"SystemLink Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2026-04","versionType":"custom"}]}],"references":["https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/authentication-bypass-vulnerability-in-ni-systemlink-enterprise.html"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:13:52.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/9xxx/CVE-2026-9051.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-9051","state":"PUBLISHED","datePublished":"2026-05-29T18:04:48.703Z","dateUpdated":"2026-05-29T18:45:55.475Z","assignerShortName":"NI","assignerOrgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateReserved":"2026-05-19T20:34:59.772Z"},"containers":{"cna":{"title":"Authentication Bypass Vulnerability in NI SystemLink Enterprise","descriptions":[{"lang":"en","value":"There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure.  Successful exploitation requires an attacker to send a specially crafted HTTP request.  This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions."}],"affected":[{"vendor":"NI","product":"SystemLink Enterprise","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2026-04","versionType":"custom"}]}],"references":[{"url":"https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/authentication-bypass-vulnerability-in-ni-systemlink-enterprise.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseSeverity":"CRITICAL","baseScore":9.1,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"CWE-306 Missing authentication for critical function","type":"CWE"}]}],"providerMetadata":{"shortName":"NI","orgId":"bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4","dateUpdated":"2026-05-29T18:04:48.703Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ni:systemlink_enterprise:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndIncluding":"2026-04"}]}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-29T18:45:46.466575Z","id":"CVE-2026-9051","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-29T18:45:55.475Z"}}]}}}