CVE

CVE-2024-26291

8.7

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

avid nexis e-seriesavid nexis f-seriesavid nexis pro+system director appliance (sda+)

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

Avid NEXIS Agent - Arbitrary File Read

Avid NEXIS E-series, F-series, PRO+, and System Director Appliance (SDA+) before 2025.5.1 contain an unauthenticated arbitrary file read caused by improper validation of the filename parameter, letting unauthenticated attackers read sensitive files, exploit requires no authentication. References: https://nvd.nist.gov/vuln/detail/CVE-2024-26291 https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html https://kb.avid.com/pkb/articles/troubleshooting/en239659 Remediation: Upgrade to Avid NEXIS version 2025.5.1 or later.

Used 3.1k times · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: avid nexis e-series

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →