To help protect your systems, customers using NI driver software 2026 Q2 or earlier should visit ni.com/ni-pal-update and follow the recommended actions.
A local privilege escalation vulnerability was recently discovered in the NI-PAL kernel driver. Many NI drivers include NI-PAL and are affected by these vulnerabilities. This vulnerability may allow a local, authenticated user to escalate privileges and execute arbitrary code.
This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows. This vulnerability is identified as CVE-2026-18485 .
NI strongly recommends upgrading the affected software to mitigate these vulnerabilities. Refer to the Mitigation Guidance section for identifying the version of NI‑PAL installed and installing the patch.
NI strongly recommends upgrading the affected software to mitigate these vulnerabilities. Refer to the Affected Products section for information on upgrading these products.
While NI-PAL is a common component in many NI drivers, you only need to upgrade one NI driver that includes this component per each machine.
This vulnerability affects NI-PAL 26.3.1 and prior versions. To determine the version of NI-PAL installed, follow the instructions for your operating system.
Identify Installed NI-PAL Version
Navigate to %WinDir%\system32\drivers folder.
Find the file nipalk.sys. Right-click on the file and select Properties .
In the Properties window, navigate to the Details tab. Note the version listed in the Product Version field.
If the NI-PAL version is 26.3.1 or prior, install the patch for Windows.
CVE-2026-18485 – 7.8 – CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-18485 – 8.5 – CVSS:4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NI Update Service is a Windows utility that checks for and delivers updates for NI software and drivers, including security updates. It can be used to manually check for updates, configured to periodically check and notify users, or to automatically download and install updates at a scheduled time.
Some mitigations in this advisory are delivered through NI Update Service. NI recommends upgrading to NI Update Service 2026 Q3 or later to get the latest updates. NI Update Service can be installed on its own and is backwards compatible with older NI software.
At NI, we view the security of our products as an important part of our commitment to our customers. Visit ni.com/security to stay informed and act upon security alerts and issues.
NI would like to thank AO031 for reporting this issue and working with us on coordinated disclosure.
CVE-2026-18485 – National Vulnerability Database
CWE-1285 – Improper Validation of Specified Index, Position, or Offset in Input
Was this information helpful?
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
