NVIDIA has launched version 2.0 of its Infrastructure Controller, a comprehensive update designed to rectify 14 vulnerabilities discovered in its Linux-based infrastructure management software. With cybersecurity concerns reaching unprecedented heights, this update represents an important step toward ensuring the robustness and security of NVIDIA’s platforms.
The vulnerabilities addressed in this critical update span a range of issues, including hard-coded credentials, which pose significant security threats. These vulnerabilities enable potentially malicious actors to exploit systems, allowing them to execute arbitrary code, escalate privileges, manipulate data, disrupt services, and access confidential information.
NVIDIA first released a security bulletin regarding these vulnerabilities on September 22, 2026. The affected versions of the NVIDIA Infrastructure Controller include releases 0 through 1.9, underlining the urgency for organizations still utilizing these outdated versions to consider immediate upgrades. The company has advised users to either clone their existing software or update to version 2.0 or later, which fixes the identified vulnerabilities.
Among the vulnerabilities, the most critical is labeled CVE-2026-65113, associated with hard-coded credentials, which has garnered a daunting CVSS score of 9.8 out of 10. This particular flaw stands out for its ability to be exploited remotely without requiring authentication or user interaction. This means that an attacker can gain significant access to the system, potentially leading to privilege escalation, data modification, service disruptions, and unauthorized information disclosure.
Another critical issue addressed in this update is CVE-2026-65128, characterized as an SQL injection vulnerability with a CVSS score of 8.8. While exploitation of this flaw requires low privileges, it poses an equally damaging potential for code execution, thereby compromising the confidentiality, integrity, and availability of affected deployments.
Further reinforcing the significance of this update, vulnerabilities related to authentication weaknesses have also been identified and resolved. For instance, CVE-2026-65114 pertains to missing authentication for a crucial function, while CVE-2026-65121 highlights an improper authentication issue that could facilitate privilege escalation. These vulnerabilities underscore the pressing need for organizations to restrict access to administrative interfaces and isolate management-plane services from untrusted networks to mitigate risks.
In addition to the previously mentioned vulnerabilities, CVE-2026-65130 presents an OS command injection vulnerability rated at 8.0. Although this flaw requires high privileges and has a complicated exploitation process, it remains a serious concern. A successful exploit could lead to arbitrary code execution, privilege escalation beyond security boundaries, data manipulation, service disruptions, and significant data exposure.
The update also addresses serious flaws related to improper certificate validation, specifically CVE-2026-65118 and CVE-2026-65129, with ratings of 7.5 and 6.7, respectively. These vulnerabilities can jeopardize trust verification during communications, paving the way for attackers possessing adjacent network access to intercept, manipulate, or expose sensitive data.
In addition to the severe issues mentioned, several other vulnerabilities have been identified. These include external control of file names or paths, XML injection, failures in workflow enforcement, hard-coded passwords, uncontrolled resource consumption, and uncleared debug information, all of which reflect a comprehensive approach to security in this update.
Overall, the vulnerabilities patched in this update span from critical to medium severity, with the Common Vulnerability Scoring System (CVSS) scores reaching as high as 9.8. With these updates, NVIDIA significantly improves the security posture of its Infrastructure Controller software, emphasizing the importance of regular updates and vigilant security practices. Organizations utilizing this software are strongly encouraged to implement these updates promptly to safeguard their systems from potential exploitation and data breaches. As cyber threats continue to evolve, maintaining strong security measures is not merely advisable; it is essential for the integrity of organizational operations. This latest update serves as a reminder of the ongoing journey toward improved cybersecurity in increasingly complex digital landscapes.