Security Notice: NVIDIA Rowhammer - August 2026

NVIDIA has released updated guidance regarding Rowhammer mitigations for NVIDIA GPU and SoC products. NVIDIA recommends a defense-in-depth posture, including enabling SYS-ECC and host IOMMU / DMA isolation. See details below. Go to NVIDIA Product Security. Details NVIDIA received follow-on resear...

PT-2026-81383

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of...

PT-2026-81499

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw for Linux affected versions not specified Description A flaw in the installation process allows an attacker to trigger the execution of untrusted code. This could result in privilege escalation, data tampering, information...

PT-2026-81506

NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure...

PT-2026-81502

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, code execution, and escalation of privileges...

PT-2026-81503

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

PT-2026-81507

NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

PT-2026-81516

Name of the Vulnerable Software and Affected Versions NVIDIA NemoClaw versions 0.0.0 through 0.0.25 Description NVIDIA NemoClaw for Linux contains a flaw in its inference server setup that allows a remote attacker to access the inference service without authentication. In affected configurations,...

CVE-2026-65088: Invocation of Process Using Visible Sensitive Information

NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-65087: Insufficiently Protected Credentials

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65084: Improper Certificate Validation

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, code execution, and escalation of privileges...

CVE-2026-65082: Improper Control of Generation of Code

NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection. A successful exploit of this vulnerability might lead to code execution, data tampering, information disclosure, and denial of service...

CVE-2026-65086: Improper Neutralization of Special Elements used in an OS Command

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering...

CVE-2026-65085: Improper Encoding or Escaping of Output

NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65083: Incomplete List of Disallowed Inputs

NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, an...

CVE-2026-65081: Download of Code Without Integrity Check

NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, information disclosure, and denial of servi...

CVE-2026-47626: Out-of-bounds Write

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...

CVE-2026-47624: Protection Mechanism Failure

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administrator password protection in UEFi...

CVE-2026-24263: NULL Pointer Dereference

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data...

CVE-2026-24262: Out-of-bounds Write

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, denial of service, information disclosure, and data tamperi...