Ni Ni-Pal vulnerabilities

4 CVEs affecting Ni Ni-Pal, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18485, published 2026-08-05.

More from Ni.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-38304, published 2021-09-17. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable escalation of privilege via local access.
• CVE-2026-18485, published 2026-08-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver.  This may allow a local, authenticated user to escalate privileges and execute arbitrary…
• CVE-2026-8036, published 2026-06-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and…
• CVE-2026-8035, published 2026-06-02. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability…