CVE-2024-26291: Avid Nexis E-Series

High severity, CVSS 8.7. EPSS: 1.1% chance of exploitation in the next 30 days.

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filename does not validate the path thus allowing users to read arbitrary files. As the application runs with the highest privileges (root/NT_AUTHORITY SYSTEM) by default attackers are able to obtain sensitive information. This issue affects Avid NEXIS E-series: before 2025.5.1; Avid NEXIS F-series: before 2025.5.1; Avid NEXIS PRO+: before 2025.5.1; System Director Appliance (SDA+): before 2025.5.1.

Affected products

• Avid Avid Nexis E-Series: before 2025.5.1 (fixed in 2025.5.1)
• Avid Avid Nexis F-Series: before 2025.5.1 (fixed in 2025.5.1)
• Avid Avid Nexis Pro+: before 2025.5.1 (fixed in 2025.5.1)
• Avid System Director Appliance Sda+: before 2025.5.1 (fixed in 2025.5.1)

Published 2025-07-14. Last modified 2026-06-17.