Loading story…
NVIDIA published September security advisories for vulnerabilities affecting NVIDIA Infrastructure Controller versions 0 through 1.9 and NVIDIA NeMo Speech versions 0.0 through 2.9. The Canadian Centre for Cyber Security and Guyana National CIRT issued follow-on alerts directing administrators to review NVIDIA’s bulletins and install the applicable updates.
The public notices did not disclose CVE identifiers, vulnerability classes, severity ratings, affected configurations, fixed-version details, or evidence of active exploitation. Organizations using either product should identify deployed versions, obtain the relevant NVIDIA updates, and prioritize remediation according to their exposure and change-management processes.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-957, directing users and administrators to review NVIDIA's Infrastructure Controller and NeMo Speech security bulletins and apply available updates.
NVIDIA published September 2026 security advisories for vulnerabilities affecting Infrastructure Controller versions 0 through 1.9 and NeMo Speech versions 0.0 through 2.9. The referenced notices did not provide CVE IDs, severity, technical details, exploitation evidence, or fixed-version information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
cirt.gy
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcenvidia.custhelp.com
Open sourcenvidia.custhelp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NVIDIA issued security advisories covering vulnerabilities in **NemoClaw**, **OpenShell**, **NVIDIA Unified Fabric Manager**, and **NVIDIA DGX Spark**. The notices identify multiple affected versions and models of NemoClaw, OpenShell, and Unified Fabric Manager; DGX Spark releases earlier than version `1.110.13` are affected. NVIDIA and the Guyana National CIRT urged administrators to review the applicable NVIDIA security bulletins and deploy relevant updates. The available advisories do not disclose CVE identifiers, vulnerability classes, severity ratings, exploitation status, or full fixed-version details beyond the DGX Spark `1.110.13` threshold.
Aug 27, 2026
NVIDIA disclosed multiple vulnerabilities affecting **Triton Inference Server**, **Cumulus Linux GA/LTS**, and **NVOS**, prompting national cyber agencies to issue follow-on advisories directing administrators to review vendor bulletins and deploy fixes. The Canadian Centre for Cyber Security and Guyana National CIRT both said the issues were identified in NVIDIA products and emphasized that the notice is a vendor security advisory rather than a report of active exploitation. Affected versions include Triton Inference Server releases prior to **`0.0-26.05`** and NVOS releases prior to **`25.0.2.4438`** and **`25.0.2.6077`**, while Cumulus Linux GA/LTS is also listed as impacted across multiple versions. NVIDIA’s product security and support bulletins were cited as the authoritative remediation source, and organizations using the affected platforms were urged to verify version exposure and apply available updates as they become available.
Aug 21, 2026
NVIDIA issued security updates for multiple products across its AI and enterprise software stack, fixing vulnerabilities that could allow **remote code execution**, denial of service, privilege escalation, data tampering, and information disclosure. The most severe issue disclosed in its broader March advisories was `CVE-2025-33244` in **NVIDIA Apex**, a widely used PyTorch extension for mixed-precision and distributed training. High-severity flaws were also addressed in **Triton Inference Server**, **Megatron LM**, **NeMo Framework**, and **Model Optimizer**, with NVIDIA warning that exploitation could disrupt AI workloads, expose sensitive training data, or enable unauthorized access. Medium-severity issues were additionally listed in **VIRTIO-Net**, **SNAP4**, and **B300 MCU**. NVIDIA later released urgent fixes for **TensorRT-LLM** and **Isaac Launchable**, including TensorRT-LLM deserialization flaws in MPI server and RPC testing components that could lead to RCE, data manipulation, information disclosure, or service outages. It also patched a Linux issue in Isaac Launchable involving sensitive information sent in clear text, creating risks of privilege escalation and system disruption. NVIDIA advised customers to upgrade **TensorRT-LLM** to `1.2.1` or later, and said organizations running multi-GPU deployments should use: ```bash trtllm-llmapi-launch ``` to reduce network exposure. The company has also begun publishing PSIRT bulletins on GitHub in Markdown and CSAF formats to support automated vulnerability management and faster remediation.
Jun 29, 2026