Do Son 
TL;DR
NVIDIA released six security bulletins on October 13, 2026, fixing 18 flaws in its AI software stack. Eight are NVIDIA AIStore vulnerabilities, including CVE-2026-65162, a maximum-severity CVSS 10.0 bug that could lead to remote code execution. All eight AIStore flaws carry a “no privileges required” rating.
- Total: 18 CVEs
- Severity: 2 Critical · 14 High · 2 Medium
- Actively exploited: None confirmed
- Highest severity: 10.0 (Critical · CVSSv3) — CVE-2026-65162
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-65162 | 10 | CWE-250 | Not exploited |
| CVE-2026-65173 | 9.1 | CWE-306 | Not exploited |
| CVE-2026-65172 | 8.6 | CWE-862 | Not exploited |
| CVE-2026-65170 | 8.6 | CWE-918 | Not exploited |
| CVE-2026-65101 | 8.6 | CWE-918 | Not exploited |
| CVE-2026-65164 | 8.1 | CWE-22 | Not exploited |
| CVE-2026-65103 | 8.1 | CWE-22 | Not exploited |
| CVE-2026-65180 | 7.8 | CWE-502 | Not exploited |
Why It Matters
AIStore is NVIDIA’s storage system for large AI datasets. It often runs inside Kubernetes clusters that also hold GPUs, models and training data. As a result, a breach there can expose valuable intellectual property.
The rest of the fixes touch popular AI developer tools: Megatron-LM, DALI, Isaac Lab, NVSentinel and Warp. NVIDIA adds a note of caution about its own scores: “The NVIDIA risk assessment is based on an average of risk across a diverse set of installed systems and might not represent the true risk to your local installation.”
How the Attacks Work
Critical NVIDIA AIStore vulnerabilities
- CVE-2026-65162 (CVSS 10.0): a legacy ETL API lets a remote attacker supply dangerous Kubernetes host and security settings. This could lead to code execution and privilege escalation.
- CVE-2026-65173 (CVSS 9.1): the token-revocation endpoint lacks authentication. An outsider could submit crafted revocation lists, causing data tampering and denial of service.
High-severity AIStore flaws
Six more AIStore bugs rate high. CVE-2026-65172 (CVSS 8.6) lets unauthenticated users view or control ETL jobs. Two server-side request forgery flaws, CVE-2026-65170 and CVE-2026-65101, could leak data. Meanwhile, two path traversal bugs allow file creation or overwrite, and a Promote API flaw allows file reads.
Other NVIDIA products
- Megatron-LM: two CVSS 7.8 flaws could run code if a user loads a malicious checkpoint file. A third bug allows cache tampering during inference.
- Isaac Lab: an eval injection flaw (CVSS 7.8) could lead to code execution.
- DALI: four memory-safety bugs, each CVSS 7.3, including a stack-based buffer overflow.
- NVSentinel and Warp: two medium-severity denial-of-service flaws.
Who is most at risk
Organizations that expose AIStore proxies or targets to wide internal networks face the greatest risk. Because none of the AIStore bugs need credentials, any attacker who reaches the service could try them. The CVSS 10.0 flaw is the most serious, since a successful attack could lead to remote code execution with impact beyond AIStore itself, as its changed-scope CVSS rating signals.
Developers face a different threat. The Megatron-LM and Isaac Lab bugs need a user to load a malicious file or input. Shared model hubs and downloaded checkpoints are the likely lures.
Who found the bugs
Several of the AIStore flaws came through the TrendAI Zero Day Initiative. Independent researchers and a team from Tsinghua University reported others across the six products.
Exploitation status
NVIDIA does not report exploitation in the wild for any of these flaws. Likewise, no public proof-of-concept has been confirmed.
Affected Versions
- AIStore: all versions through 4.9 on Linux
- Megatron-LM: versions before 0.17.1
- DALI: versions through 2.2
- Isaac Lab: versions through 2.3.2
- NVSentinel: version 1.19.0
- Warp: versions 1.13.0, 1.14.0 and 1.15.0
Patch and Mitigation Steps
- Upgrade AIStore to version 5.0.
- Update Megatron-LM to 0.17.1 or later.
- Move DALI to 2.3, Isaac Lab to 3.0-beta2, NVSentinel to 1.20.0 and Warp to 1.16.0.
- Keep AIStore proxies and targets off public networks, and restrict access to its APIs.
- Only load model checkpoints from trusted sources.
Teams running AI clusters should patch the NVIDIA AIStore vulnerabilities first, since several need no authentication.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
