CVE-2026-37452: MSI NBFoundation Service Information Disclosure Vulnerability

Technical summary

CVE-2026-37452 is an insecure permissions vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in MSI NBFoundation Service v.2.0.2506.1201. The MSIAPService.exe component fails to enforce adequate access restrictions, permitting unauthenticated remote information disclosure. The attack vector is network-based, requires no privileges or user interaction, and impacts the confidentiality of sensitive data without affecting system integrity or availability. The CVSS 3.1 score of 7.5 (HIGH) reflects the remote, no-authentication attack profile combined with high confidentiality impact.

Business impact

Unauthorized disclosure of sensitive information stored or processed by the NBFoundation Service could expose customer data, credentials, configuration details, or proprietary information depending on what the service manages. This may result in regulatory compliance violations (GDPR, HIPAA, PCI-DSS if applicable), reputational damage, and potential lateral movement by attackers who use disclosed credentials or architectural knowledge. Organizations relying on this service for data management should assess what information is at risk within their specific deployments.

Affected systems

MSI NBFoundation Service version 2.0.2506.1201 is confirmed affected. The vulnerability is accessed through the MSIAPService.exe component. Organizations should verify whether they have this version deployed in their infrastructure, including any systems where the service is installed in server, workstation, or embedded contexts. Check both production and development environments.

Exploitability

This vulnerability has a low barrier to exploitation: an attacker on the network requires no authentication, no privilege escalation, and no user interaction to attempt information disclosure. The straightforward attack surface (direct network access to MSIAPService.exe) and absence of complex conditions make it practically exploitable by adversaries with basic reconnaissance capabilities. However, the attack is not currently listed on CISA's Known Exploited Vulnerabilities catalog, suggesting either limited public weaponization at this time or that exploitation requires some environmental knowledge.

Remediation

Priority remediation is to upgrade MSI NBFoundation Service beyond version 2.0.2506.1201 to a patched release. Consult the MSI vendor advisory for the specific corrected version number and deployment procedures. In the interim, apply network-level controls to restrict access to MSIAPService.exe (typically listening on specific ports)—limit network connectivity to this service to trusted internal subnets only, and implement host-based firewall rules to deny unauthorized inbound connections. Monitor the service component for unexpected access attempts.

Patch guidance

Contact MSI for the official patched version of NBFoundation Service. Verify the update is available for your deployment model and apply through MSI's standard update mechanism. Test the patch in a staging environment first to confirm compatibility with dependent applications or integrations. Once validated, schedule the upgrade across your infrastructure, prioritizing systems that are internet-exposed or handle critical data. Document the patched version for compliance and audit trails.

Detection guidance

Monitor network traffic to the port(s) on which MSIAPService.exe listens for unusual or unauthorized client connections. Enable service-level logging for MSIAPService.exe if available, and review logs for access from unexpected IP addresses or processes. Deploy intrusion detection or network analytics to flag reconnaissance or suspicious queries targeting the service. Check process execution and file access logs to identify attempts to interact with or extract data from the service component. Alert on version checks or fingerprinting activity that suggests adversaries are probing for this specific service.

Why prioritize this

The HIGH severity is driven by the combination of remote, unauthenticated attack vector and high-confidence confidentiality impact. Lack of KEV listing does not reduce the intrinsic risk—it may simply indicate limited public awareness or active exploitation at the time of CVE publication. Organizations should treat this as a priority patch based on the technical characteristics and their own data exposure profile, not the KEV status.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: (1) Network attack vector (AV:N)—remotely exploitable; (2) Low attack complexity (AC:L)—no special conditions; (3) No privileges required (PR:N) and no user interaction (UI:N); (4) Unchanged scope (S:U); (5) High confidentiality impact (C:H)—sensitive information disclosed; (6) No integrity (I:N) or availability (A:N) impact. This places it in the HIGH band, warranting rapid remediation but not critical-level urgency if network segmentation limits exposure.

Frequently asked questions