CVE-2026-24241
Published: 24 February 2026
Summary
CVE-2026-24241 is a medium-severity Improper Authentication (CWE-287) vulnerability in Nvidia Delegated License Service. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 26.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-9 (Service Identification and Authentication).
Deeper analysis
CVE-2026-24241 affects the NVIDIA Delegated Licensing Service across all appliance platforms. The vulnerability stems from an improper authentication issue, mapped to CWE-287, which could enable information disclosure upon successful exploitation. Published on 2026-02-24, it carries a CVSS v3.1 base score of 4.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact and no effects on integrity or availability.
An adjacent network attacker (AV:A) with no required privileges (PR:N) can exploit this vulnerability through low-complexity means (AC:L) without user interaction (UI:N). Exploitation remains scoped to unchanged impact (S:U), potentially resulting in limited information disclosure.
Mitigation guidance is available in official advisories, including NVIDIA's security bulletin at https://nvidia.custhelp.com/app/answers/detail/a_id/5789, the NVD detail page at https://nvd.nist.gov/vuln/detail/CVE-2026-24241, and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-24241.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8552
Vulnerability details
NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit an improper authentication issue. A successful exploit of this vulnerability might lead to information disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper authentication (CWE-287) in a network-exposed licensing service directly enables remote exploitation for unauthorized data access, mapping to Exploitation of Remote Services.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authentication checks before granting access to the Delegated Licensing Service, blocking the improper-authentication path to information disclosure.
Requires the licensing service itself to be identified and authenticated before any client interaction, directly mitigating the CWE-287 flaw.
Mandates authentication and encryption for all remote/adjacent-network access to the appliance-hosted licensing service, limiting unauthenticated disclosure.