CVE-2026-37454: MSI NBFoundation Service Information Disclosure via Insecure Permissions

Technical summary

CVE-2026-37454 is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) vulnerability in the MSI NBFoundation Service component. The flaw arises from insecure permission settings that expose cryptographic material or encrypted data to remote, unauthenticated attackers. The use of 3DES-ECB encryption—a legacy cipher mode with known weaknesses in pattern preservation and deterministic encryption properties—compounds the issue by failing to provide adequate confidentiality even if access controls were properly enforced. The network-accessible nature of the service (CVSS vector AV:N) means exploitation is trivial from a connectivity perspective.

Business impact

Organizations deploying MSI Center and relying on the NBFoundation Service to handle sensitive information face direct data exposure risk. Confidential configuration data, credentials, authentication tokens, or user information encrypted with 3DES-ECB become readable to networked attackers without authentication. This undermines trust in data protection mechanisms and may trigger compliance violations (GDPR, HIPAA, PCI-DSS depending on data classification). The HIGH severity rating reflects the combination of network accessibility and high confidentiality impact.

Affected systems

MSI Center users with NBFoundation Service version 2.0.2506.1201 are affected. This component is commonly included in MSI's system management and driver software ecosystem. Systems running this specific version on networks accessible to potential attackers (including the internet if exposed) are at direct risk. Organizations should audit their deployment inventory to identify affected instances, particularly in environments handling sensitive data.

Exploitability

Exploitation requires no authentication, no user interaction, and minimal technical complexity—an attacker needs only network access to the service endpoint. The CVSS access vector (AV:N) and attack complexity (AC:L) indicate this is straightforward to exploit. No vulnerability in CVE-2026-37454 has been designated as known exploited (KEV status is false), but the low attack complexity and high accessibility make it an obvious target for opportunistic reconnaissance and data exfiltration campaigns.

Remediation

Immediately identify systems running MSI NBFoundation Service version 2.0.2506.1201 within your environment. Check the MSI security advisory for patched versions (verify against vendor releases). Apply updates to affected systems as soon as they become available. As an interim mitigation, restrict network access to the NBFoundation Service using firewall rules, VLANs, or host-based access controls to limit exposure. Do not rely on the encryption alone to protect sensitive data until permissions are corrected and the service is patched.

Patch guidance

MSI will release a patched version addressing the insecure permissions issue. Monitor MSI's official security bulletins and the Center software update mechanism for available fixes. Patches should be tested in a non-production environment before broad rollout. Given the HIGH severity and network-accessible attack vector, prioritize patching within days rather than weeks. If MSI Center is deployed via group policy or centralized management, leverage those channels to accelerate updates across your fleet.

Detection guidance

Monitor network traffic to identify suspicious connections to MSI NBFoundation Service ports. Log and alert on failed and successful authentication attempts (or lack thereof) to the service. Review process execution logs for unexpected access to configuration or credential storage directories. Use endpoint detection and response (EDR) tools to detect unusual data reads from services or processes associated with MSI Center. Check for lateral movement patterns following successful exploitation, as attackers will likely attempt to extract and exfiltrate recovered data.

Why prioritize this

This vulnerability merits immediate attention due to the HIGH CVSS score (7.5), network accessibility, and absence of authentication barriers. The flaw directly exposes sensitive information rather than enabling code execution, but the ease of exploitation and broad reach make it a top-tier priority for rapid patching. Organizations should treat this as a critical data protection issue requiring urgent remediation.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects a network-reachable vulnerability (AV:N) with low attack complexity (AC:L) requiring no privileges or user interaction (PR:N, UI:N). The confidentiality impact is rated High (C:H), meaning an attacker can access all or substantially all sensitive data. Integrity and availability are unaffected (I:N, A:N), focusing the impact on information disclosure. The absence of scope changes (S:U) limits the impact to the vulnerable component itself.

Frequently asked questions