CVE-2026-9142 -- CVSS 9.1 Vulnerability Briefing

CVE-2026-9142 | CVSS 9.1 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-9142 is an insecure default credentials vulnerability in National Instruments (NI) grpc-device server, affecting NI InstrumentStudio and the NI gRPC Device Server, where the absence of TLS configuration combined with network-exposed bindings allows unauthenticated remote access.

Technical Detail

The flaw exists when the NI gRPC Device Server is configured without TLS and bound to a network interface beyond the loopback address, leaving the service accessible to remote hosts with no authentication enforced. An unauthenticated attacker on the same network segment, or potentially over a routed network depending on firewall posture, can connect directly to the gRPC endpoint and interact with device instrumentation functionality without supplying credentials. The impact includes unauthorized access to instrument control and data acquisition operations, which in industrial or laboratory environments could result in manipulation of test equipment, data integrity compromise, or disruption of measurement workflows.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as none, meaning no public proof-of-concept or weaponized tooling has been observed. However, the vulnerability requires no authentication and no complex preconditions beyond network reachability, which lowers the practical barrier to exploitation significantly.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been identified in connection with this vulnerability.

What To Do

Organizations running NI InstrumentStudio or the NI gRPC Device Server should immediately audit all deployments to determine whether TLS is configured and whether the server is bound to any interface beyond loopback. Where TLS is not configured, it should be enabled as the primary remediation step. If TLS cannot be immediately applied, the server should be restricted to loopback binding or isolated behind host-based or network-level firewall rules that block external access to the gRPC port. Check NI's security advisories and apply any available patches or updated configurations from the vendor. Detection should focus on unexpected inbound connections to the gRPC service port from non-local addresses, particularly in environments where the server was assumed to be locally scoped.