Loading story…
NVIDIA released security updates for its Linux-based Triton Inference Server addressing two high-severity vulnerabilities that could enable denial of service, information disclosure, and data tampering. The flaws affect AI-inference infrastructure, making timely remediation important for organizations that expose or rely on Triton workloads.
The Canadian Centre for Cyber Security identified affected Triton version ranges as 0.0 through 26.03 and 0.0 through 26.06, and advised administrators to review NVIDIA’s security bulletin and product-security guidance and apply available updates. The advisories did not disclose CVE identifiers, technical vulnerability details, specific fixed versions, or evidence of active exploitation.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-900 regarding vulnerabilities in NVIDIA Triton Inference Server. It identified versions through 26.03 and 26.06 as affected and urged users to review NVIDIA guidance and apply updates.
NVIDIA released a Linux Triton Inference Server update addressing two high-severity vulnerabilities. Their impacts include denial of service, information disclosure, and data tampering.
Arm published an advisory covering nine Mali GPU vulnerabilities and released fixes for Valhall and Arm 5th Gen GPU Architecture kernel and userspace drivers. The issues may permit use-after-free access, kernel-information exposure, or denial of service; Bifrost drivers are also affected.
AMD published a security advisory for CVE-2026-43603, reported by Maxime Rossi Bellom and Ramtine Tofighi Shirazi of SecMate. The flaw can be triggered through a graphics-memory-management clear operation under certain compute-processing conditions.
AMD released fixes in July 2026 for CVE-2026-43603 affecting EPYC, Athlon, Ryzen, Radeon, and Instinct products. The NULL-pointer dereference in the Linux GPU kernel driver can crash systems and cause denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecirt.gy
Open sourcenvidia.custhelp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NVIDIA disclosed multiple vulnerabilities affecting **Triton Inference Server**, **Cumulus Linux GA/LTS**, and **NVOS**, prompting national cyber agencies to issue follow-on advisories directing administrators to review vendor bulletins and deploy fixes. The Canadian Centre for Cyber Security and Guyana National CIRT both said the issues were identified in NVIDIA products and emphasized that the notice is a vendor security advisory rather than a report of active exploitation. Affected versions include Triton Inference Server releases prior to **`0.0-26.05`** and NVOS releases prior to **`25.0.2.4438`** and **`25.0.2.6077`**, while Cumulus Linux GA/LTS is also listed as impacted across multiple versions. NVIDIA’s product security and support bulletins were cited as the authoritative remediation source, and organizations using the affected platforms were urged to verify version exposure and apply available updates as they become available.
Aug 21, 2026
NVIDIA patched multiple **critical vulnerabilities** in Triton Inference Server that can let remote, unauthenticated attackers crash or fully compromise AI inference servers exposed over HTTP. The issues affect Triton versions prior to `25.07` on Linux and Windows and include stack and heap memory corruption flaws such as **CVE-2025-23310**, **CVE-2025-23311**, **CVE-2025-23317**, **CVE-2025-23318**, and the related Python-backend chain **CVE-2025-23319**, **CVE-2025-23320**, and **CVE-2025-23334**. Several bugs stem from unsafe HTTP request parsing and chunked transfer handling, while others arise from improper validation in Triton’s shared memory and Python backend components, creating paths to denial of service, information disclosure, data tampering, and remote code execution.
Jun 29, 2026
NVIDIA disclosed Security Bulletin **5865** for **NVIDIA Triton Inference Server**, publishing advisory materials and associated MITRE-format CVE records for five vulnerabilities: `CVE-2026-47606`, `CVE-2026-47627`, `CVE-2026-47628`, `CVE-2026-47629`, and `CVE-2026-47630`. The bulletin was released through NVIDIA's product-security repository with CSAF, Markdown, checksum, and CVE JSON files, indicating a coordinated vendor advisory covering multiple issues in the inference-serving platform. The most severe issue publicly detailed is **`CVE-2026-47627`**, a **critical** path traversal vulnerability (`CWE-22`) affecting **NVIDIA Triton Inference Server on Linux** in versions **0.0 through 26.05**. The CVE record assigns a **CVSS v3.1 score of 9.8** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, and NVIDIA states that successful exploitation could lead to **denial of service**.
Aug 18, 2026