TI-2026-03578 Aliases CVE-2026-4129 GHSA-f777-xf39-r6fm

Improper Access Controls in NI SystemLink

LOW 39CWE-862Published 2026-09-10 · Updated 2026-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0035 28th percentileScored 2026-11-07

Fix Fixed SystemLink (NI): 26.5.0SystemLink Server (NI): 26.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NI	SystemLink	before 26.5.0	26.5.0	Patch available	CNA
NI	SystemLink Server	before 26.5.0	26.5.0	Patch available	CNA

SystemLink VendorNI Affected before 26.5.0 Fixed in 26.5.0 Patch available CNA
SystemLink Server VendorNI Affected before 26.5.0 Fixed in 26.5.0 Patch available CNA

Remediation

Fix · CNA SystemLink (NI) Fixed in 26.5.0
Fix · CNA SystemLink Server (NI) Fixed in 26.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-10
NI SystemLink, SystemLink Server 26.5.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-03579 Storage of Sensitive Information in Cleartext in NI SystemLinkPriority LOW 37
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-4129
2026-10-03 Alias added: GHSA-f777-xf39-r6fm

References

Other 1

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/improper-access-controls-in-ni-systemlink.html

TI-2025-02142 Path traversal in NI FlexLogger CVSS 3.1HIGH 8.8
TI-2024-05673 Incorrect Default Directory Permissions for NI SystemLink Redis Service CVSS 3.1MEDIUM 5.5
TI-2024-03773 Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio CVSS 3.1HIGH 7.8
TI-2024-06309 Missing Authorization Checks In NI VeriStand Gateway For Project Resources CVSS 3.1CRITICAL 9.8
TI-2024-06297 Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server CVSS 3.1CRITICAL 9.8
TI-2024-06296 Deserialization of Untrusted Data in NI VeriStand DataLogging Server CVSS 3.1CRITICAL 9.8

See all 115 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences