High severity · published Sep 10, 2026
CVE-2026-4130
Storage of Sensitive Information in Cleartext in NI SystemLink
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
SystemLink · NI
before 26.5.0 · source: vendor
SS
SystemLink Server · NI
before 26.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4130
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4130
www.ni.com
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html
More from SystemLink
8.1
CVE-2026-4129
Improper Access Controls in NI SystemLink
7.8
CVE-2024-6121
An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834
6.1
CVE-2022-27237
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products
5.5
CVE-2024-6122
An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access