CVE-2026-24186
Published: 28 April 2026
Summary
CVE-2026-24186 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Nvidia Nvflare. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents exploitation by validating and sanitizing FOBS-encoded messages to block deserialization of untrusted data.
Remediates the root deserialization flaw in the NVIDIA FLARE SDK FOBS component through timely identification, reporting, and patching.
Mitigates arbitrary code execution from deserialization exploits via memory protection mechanisms such as DEP and ASLR.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data (CWE-502) over a network-accessible interface directly enables remote arbitrary code execution in the FLARE FOBS component, mapping to exploitation of a public-facing application (T1190) followed by Python-based command execution (T1059.006).
NVD Description
NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.
Deeper analysisAI
CVE-2026-24186 is a vulnerability in the NVIDIA FLARE SDK, specifically within its FOBS component, that enables deserialization of untrusted data. An attacker can trigger this by sending a malicious FOBS-encoded message, potentially leading to arbitrary code execution. The issue is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low complexity, and significant impacts on confidentiality, integrity, and availability.
Exploitation requires low privileges (PR:L) and can be performed over the network (AV:N) with low attack complexity and no user interaction. A successful attack allows the adversary to achieve code execution on the targeted system, compromising high levels of confidentiality, integrity, and availability without changing scope.
Mitigation details are available in published advisories, including the NVIDIA security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5819, as well as NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-24186 and CVE record https://www.cve.org/CVERecord?id=CVE-2026-24186. The vulnerability was published on 2026-04-28.
Details
- CWE(s)