CVE-2026-4130

CVE-2026-4130 is a cleartext storage of sensitive information flaw (CWE-312) in NI SystemLink, where sensitive data such as credentials or secrets is written to disk unencrypted. An attacker who gains local access to a deployed system, with only low privileges and no user interaction required, can read this information directly from the system's storage. Successful exploitation exposes whatever sensitive data the product stores in the clear, which could enable further access to the SystemLink environment or connected infrastructure. All NI SystemLink and NI SystemLink Server deployments at version 2026 Q3 or earlier are affected. There is no evidence of active exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade NI SystemLink and NI SystemLink Server to a release newer than 2026 Q3 per NI's advisory (a specific fixed version was not provided in this data). Restrict local access to SystemLink hosts, and audit the installation directories and configuration stores for plaintext credentials, which should be rotated if found.