Do Son 
TL;DR
NVIDIA patched a critical NVIDIA Triton vulnerability tracked as CVE-2026-47627. The flaw scores a CVSS base of 9.8 and can trigger denial of service. A remote, unauthenticated attacker needs no user interaction to exploit it. Update to Triton Inference Server 26.06 to stay safe.
- Product: NVIDIA (2 products)
- Vulnerabilities: 3 flaws (CVE-2026-47627, CVE-2026-47628, CVE-2026-24184)
- Highest severity: 9.8 (Critical · CVSSv3)
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Fixed in | Status |
|---|---|---|---|
| CVE-2026-47627 | 9.8 | — | Not exploited |
| CVE-2026-47628 | 7.5 | — | Not exploited |
| CVE-2026-24184 | 7.5 | — | Not exploited |
Why it matters
Triton Inference Server runs AI models in production for many organizations. A crash there can take live model endpoints offline. CVE-2026-47627 earns its critical rating because it needs no login. An attacker can reach it straight over the network.
NVIDIA disclosed the bug in its August 2026 Triton Inference Server bulletin. The company rated the issue 9.8 on the CVSS v3.1 scale. That places it among the most urgent fixes this month.
How the attack works
The NVIDIA Triton vulnerability stems from a path traversal weakness, classified as CWE-22. An attacker sends crafted input to reach files outside the intended directory. As a result, the server can fail and stop responding.
NVIDIA lists four more Triton flaws alongside it. CVE-2026-47628 (CVSS 7.5) allows resource exhaustion through unlimited allocation. CVE-2026-47629 (CVSS 7.5) abuses improper input validation. Both also lead to denial of service. Two medium-severity path traversal bugs round out the set.
NVIDIA reports no evidence of exploitation in the wild. No public proof-of-concept exists at this time. Still, the low attack complexity raises the risk.
A second bulletin lands the same day
NVIDIA also fixed three flaws in Cumulus Linux and NVOS switches. CVE-2026-24184 (CVSS 7.5) allows a buffer overflow through crafted LLDP frames. That flaw can lead to code execution on affected switches. NVIDIA covers these in a separate Cumulus Linux and NVOS advisory.
Affected versions
The Triton bugs affect all Linux builds from 0.0 through 26.05. The Cumulus Linux GA flaw hits version 5.15. NVOS issues affect specific GB300 and IBSwitch XDR builds.
Patch and mitigation steps
Update Triton Inference Server to version 26.06 or later. For Cumulus Linux, move to 5.16, or to 5.11.5 and 5.9.5 on LTS branches. NVOS users should install the fixed builds from the support portal. Apply these updates quickly, since the CVE-2026-47627 denial of service flaw carries the highest score in this round.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
