CVE-2026-24186:

CVE-2026-24186 is a high-severity deserialization vulnerability in NVIDIA FLARE SDK's FOBS component that could allow an authenticated remote attacker to execute arbitrary code.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Apr 28, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:LOW
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

CVE-2026-24186 is a high-severity deserialization vulnerability in NVIDIA FLARE SDK's FOBS component that could allow an authenticated remote attacker to execute arbitrary code.

Overview

CVE-2026-24186 affects the NVIDIA FLARE SDK, specifically within its FOBS (FLARE Object Serialization) subsystem. The vulnerability arises from insecure deserialization of untrusted data (CWE-502), a class of flaw that allows attackers to supply crafted serialized objects that, when processed by the application, can trigger arbitrary code execution. The attack can be conducted remotely over a network by a low-privileged authenticated user without requiring any user interaction. With a CVSS 3.1 score of 8.8 (HIGH) and high impacts across confidentiality, integrity, and availability, this vulnerability poses a significant risk to deployments of NVIDIA FLARE SDK that are exposed to untrusted or partially trusted network participants. NVIDIA FLARE is commonly used in federated learning environments, meaning exploitation could compromise not only individual nodes but potentially the integrity of collaborative machine learning workflows.

Remediation

Users and administrators of NVIDIA FLARE SDK are strongly advised to review NVIDIA's official security advisory (NVIDIA Security Bulletin Answer ID 5819) for specific patched versions and upgrade guidance. General remediation steps include upgrading to the latest patched version of NVIDIA FLARE SDK as released by NVIDIA, restricting network access to FLARE SDK endpoints to only trusted and authenticated participants, implementing network-level controls such as firewalls or VPNs to limit exposure of FLARE services to untrusted networks, and monitoring for anomalous deserialization activity or unexpected code execution patterns within FLARE deployments until patches can be applied.