NVIDIA has issued a crucial security update for its Infrastructure Controller software on Linux systems, addressing 14 critical vulnerabilities. These flaws could potentially enable unauthorized access to sensitive information, code execution, data modification, and system disruption.
Details of the Security Update
The update, detailed in NVIDIA’s September 2026 security bulletin, affects software versions from 0 to 1.9. Organizations are strongly advised to upgrade to version 2.0 or higher to mitigate all identified vulnerabilities.
Among the vulnerabilities addressed is CVE-2026-65127, which involves uncleared debug information and carries a CVSS score of 4.1. This medium-severity flaw could allow an attacker with high privileges and local access to extract sensitive system information.
Critical Vulnerabilities Explained
One of the most severe vulnerabilities, CVE-2026-65113, is associated with hard-coded credentials and has a CVSS score of 9.8. This flaw allows a remote attacker to gain elevated privileges and potentially manipulate data or cause a denial-of-service condition.
Another significant issue, CVE-2026-65128, involves an SQL injection vulnerability with a CVSS score of 8.8. This flaw could lead to code execution, data manipulation, and service disruption without requiring user interaction.
Additional Security Concerns
Other prominent vulnerabilities include missing authentication for critical functions, OS command injection, and improper certificate validation. These issues range from CVSS scores of 6.5 to 8.3 and pose risks such as privilege escalation and data exposure.
NVIDIA also addressed vulnerabilities related to external control of file paths, XML injection, and hard-coded password use. These fixes are crucial for maintaining the integrity of systems managing NVIDIA infrastructure components.
Recommendations for Organizations
Organizations should promptly update their Infrastructure Controller software to version 2.0 or later and review their access controls, credentials, logs, and network segmentation. Although NVIDIA’s severity ratings reflect general risk levels, security teams should assess their specific environment configurations to determine exposure.
Timely remediation of these vulnerabilities is essential to safeguard against potential exploitation and maintain robust system security.
