# CVE-2026-4129: NI SystemLink improper access control vulnerability

Source: https://junglewise.ai/threats/cve-2026-4129-ni-systemlink-improper-access-control-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-4129 · Severity: high · CVSS 8.1 · Published 2026-09-10

NI SystemLink is a software platform used for managing and monitoring networked systems and devices. An authenticated attacker with limited privileges can bypass access controls to read sensitive host operating system files and directories that should be restricted, potentially exposing configuration data, credentials, or other sensitive system information.

Vendors: [NI](https://junglewise.ai/threats/vendors/ni).

## Quick answers

**Is CVE-2026-4129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4129 being exploited in the wild.

**How severe is CVE-2026-4129?** High severity, with a CVSS score of 8.1, published 10 September 2026.

**Which products and versions are affected?** NI SystemLink prior to 2026 Q3; NI SystemLink Server prior to 2026 Q3.

**Is there a fix for CVE-2026-4129?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4129 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-4129?** Check whether you run NI SystemLink or NI SystemLink Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an improper access control (CWE-862: Missing Authorization) vulnerability in NI SystemLink and NI SystemLink Server. An authenticated user with limited privileges can access host OS files and directories that should be restricted, indicating insufficient authorization checks in the file access control logic. The vulnerability requires network access and an authenticated session (PR:L), with no user interaction required. An attacker can achieve high confidentiality and integrity impact. The fix is to upgrade to NI SystemLink 2026 Q3 or later.

## Affected products

- NI SystemLink prior to 2026 Q3
- NI SystemLink Server prior to 2026 Q3

## Timeline

- 2026-09-10: disclosed
- 2026-09-17: advisory

## References

- [https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/improper-access-controls-in-ni-systemlink.html](https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/improper-access-controls-in-ni-systemlink.html)