vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-26290

Authenticated Remote Command Injection affecting Avid NEXIS

HIGH
8.7
CVSS Score
Published: March 12, 2025 at 07:45 PM UTC
Updated: June 17, 2026 at 07:17 AM UTC
4 products affected across 1 vendorAvid NEXIS E-seriesNexis Pro PlusAvid NEXIS F-series

Using Avid NEXIS E-series by Avid?

Get instant alerts when new vulnerabilities affect Avid NEXIS E-series - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.7
Exploit prediction
EPSS 0.5%
SSVC
PoC

Description

Improper Input Validation vulnerability in Avid Avid NEXIS E-series on Linux, Avid Avid NEXIS F-series on Linux, Avid Avid NEXIS PRO+ on Linux, Avid System Director Appliance (SDA+) on Linux allows code execution on underlying operating system with root permissions.This issue affects Avid NEXIS E-series: before 2024.6.0; Avid NEXIS F-series: before 2024.6.0; Avid NEXIS PRO+: before 2024.6.0; System Director Appliance (SDA+): before 2024.6.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Avid NEXIS E-series· Avid
60%
v < 2024.6.0
Affected range stops below 2024.6.0, so it looks safe — our inference, not a vendor statement
Avid NEXIS F-series· Avid
60%
v < 2024.6.0
Affected range stops below 2024.6.0, so it looks safe — our inference, not a vendor statement
Nexis Pro Plus· Avid
60%
v < 2024.6.0
Affected range stops below 2024.6.0, so it looks safe — our inference, not a vendor statement
System Director Appliance· Avid
60%
v < 2024.6.0
Affected range stops below 2024.6.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

Vendor Advisory
Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
https://kb.avid.com/pkb/articles/troubleshooting/en239659
Third Party Advisory
Source: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
https://www.drive-byte.de/en/blog/avid-nexis-agent-multiple-vulnerabilities
Third Party AdvisoryTechnical Description
Source: af854a3a-2127-422b-91ae-364da2661108
https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html

SSVC — Action Prioritization

SSVCPoCNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.7HIGHENISA
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card