CVE-2026-37453: MSI NBFoundation Service Insecure Permissions Information Disclosure

Technical summary

CVE-2026-37453 is an information disclosure vulnerability rooted in improper access controls on an inter-process communication (IPC) named pipe. The MSI_SERVICE_2 pipe in NBFoundation Service 2.0.2506.1201 does not enforce sufficiently restrictive permissions, allowing unauthorized remote callers to establish connections and retrieve sensitive data. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and carries a CVSS v3.1 score of 7.5 (High severity) with a network-based attack vector requiring no privileges or user interaction.

Business impact

This vulnerability enables attackers to harvest sensitive information from affected MSI Center systems without triggering user alerts or requiring system compromise. Organizations relying on MSI Center for system management or monitoring could expose configuration details, credentials, or operational intelligence. The low barrier to exploitation—requiring only network access—means any exposed instance becomes an information gathering point for reconnaissance or targeted attacks. Depending on what data the MSI_SERVICE_2 pipe exposes, downstream risks could include lateral movement or supply chain intelligence gathering on enterprise networks.

Affected systems

The vulnerability affects MSI NBFoundation Service version 2.0.2506.1201 shipped with MSI Center. Any system running this specific version or earlier releases of MSI Center that bundle the vulnerable NBFoundation Service component is in scope. This includes both consumer and potentially enterprise deployments of MSI Center on Windows systems where the service is installed and running.

Exploitability

Exploitation requires only network-level access to the affected system; no authentication, elevated privileges, or user interaction is necessary. An attacker can connect to the MSI_SERVICE_2 named pipe over the network and issue queries to extract sensitive information. This low-friction attack surface and the absence of authentication barriers make this vulnerability highly exploitable in any environment where MSI Center is exposed to untrusted networks or where internal lateral movement is possible.

Remediation

Update MSI NBFoundation Service to a patched version released by MSI. Check the MSI Center product page or security advisories for the minimum patched version that addresses CVE-2026-37453. If an immediate update is not available, consider temporarily disabling or isolating MSI Center systems from untrusted network segments until a patch is deployed. Verify against the vendor advisory for the exact remediation steps and compatibility considerations.

Patch guidance

MSI should have released a security update addressing the insecure permissions on the MSI_SERVICE_2 pipe. Obtain the latest MSI Center release from the official MSI website or your organization's software distribution channel. Before deploying to production, test the patch in a staging environment to ensure compatibility with your monitoring and management workflows. Consult the MSI security advisory or release notes for specific version numbers and installation procedures.

Detection guidance

Monitor for unexpected connections to the MSI_SERVICE_2 named pipe from non-standard processes or remote sources. Audit named pipe access logs and IPC communication on systems running MSI Center, particularly looking for repeated queries or connection attempts from processes outside the expected MSI Center service accounts. Endpoint detection and response (EDR) tools can flag suspicious named pipe activity. Additionally, scan your environment to identify which systems are running vulnerable versions of MSI Center and prioritize them for patching.

Why prioritize this

This vulnerability merits rapid remediation due to its high CVSS score (7.5), network attack vector, and the absence of exploitation barriers. Unlike many information disclosure flaws that require specific conditions, this one allows any networked attacker to passively harvest data. Organizations should treat it as a priority patch, especially if MSI Center is deployed in security-sensitive environments or on systems with access to valuable operational data.

Risk score, explained

The CVSS v3.1 score of 7.5 reflects a High-severity vulnerability with complete confidentiality impact (an attacker can read all accessible sensitive information) and no integrity or availability impact. The score is driven by the network attack vector (AV:N), low attack complexity (AC:L), requirement for no privileges (PR:N), and no user interaction (UI:N). While the impact is limited to information disclosure, the ease of exploitation and network accessibility elevate the overall risk rating.

Frequently asked questions