Required NI-PAL Security Update

Aug. 5, 2026 | Vulnerability disclosed 

NI disclosed the NI-PAL security vulnerability.

Sept. 30, 2026 | Initial blocklist timeline communicated 

NI communicated Microsoft’s planned vulnerable driver blocklist enforcement and the expected Nov. 10 timeline.

Oct. 26, 2026 | Microsoft pauses blocklist addition 

Microsoft has paused adding affected versions of NI-PAL (26.3.1 and earlier) to the vulnerable driver blocklist. 

This pause provides additional time to plan and complete updates. However, it does not resolve the underlying security vulnerability, and security products may flag affected versions of NI-PAL as vulnerable.

Systems running NI-PAL 26.3.1 or earlier are vulnerable as described above. In addition, security products may begin to flag vulnerable versions of NI-PAL resulting in customers experiencing the following symptoms:

• Installation failures 
• Driver quarantine or removal 
• Application startup issues 
• Warning or error messages during installation 
• Unexpected operational disruptions

You should identify systems running affected versions of NI-PAL and update them as soon as possible. Not updating will increase security exposure and the likelihood of future compatibility or operational issues.

If you are using new systems, you should use software versions 2026 Q3 or later. If you must use older driver versions, installing NI-PAL 26.5.0 first is the preferred approach for new system builds because it helps prevent installer errors in case newer security software detects the vulnerability and takes steps to quarantine it.

1. Check the installed version—Open %WinDir%\system32\drivers, locate nipalk.sys, open Properties, and review Product Version on the Details tab.
2. Install the update—If the version is 26.3.1 or earlier, install NI-PAL 2026 Q3 or later using NI Update Service or the offline installer from the NI-PAL download page.
   Note: If you are using NI Update Service, you may need to first update NI Package Manager to see the available update.
3. Restart the system—The update takes about one minute to install and requires a restart.
4. Validate operation—After restarting, complete the recommended validation checks below.
   • Confirm the device is available in NI MAX or NI Hardware Manager.
   • Run Device Self-Test and Reset.
   • Run a Test Panel or an example program that uses the hardware.

The following video shows the full upgrade process.

• We do not recommend disabling the Microsoft vulnerable driver blocklist as a general workaround. Doing so can reduce Windows protection against known vulnerable kernel drivers.
• No known exploits for CVE-2026-18485 were known at the time of the source announcement.
• The Windows blocklist is enforced only on Windows systems. We encourage Linux customers to also follow the latest security advisories to ensure timely notice of critical and security-relevant NI software updates, and update software as needed to stay secure.
• Customers should enable NI Update Service notifications and subscribe to NI security advisories for future updates.

• Read the CVE-2026-18485 security advisory
• Get information about NI security advisories and subscription
• Enable periodic checking in NI Update Service
• NI-IMAQdx 19.5 and Earlier Incompatible with NI-PAL 2026 Q3

If you have any questions, concerns, or would like to discuss this issue further, please don’t hesitate to reach out to our technical support team.