Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Privilege escalation in the HPE Networking Fabric Composer API allows authenticated low-privilege operator users to invoke state-changing API operations beyond their authorized scope, including modifications to configurations of network systems managed by the platform. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/I:H) confirms the flaw is remotely exploitable with no complexity or interaction requirements, and that the integrity impact extends beyond Fabric Composer itself to the downstream network infrastructure it manages. No public exploit code or CISA KEV listing is present at time of analysis, but the low exploitation barrier - a valid low-privilege credential - makes this a meaningful insider and credential-theft escalation risk.
Privilege escalation in Easybyte Software's Konga before 2.1.0 allows any authenticated local Windows user to execute arbitrary code at the privilege level of the account running Konga by planting attacker-controlled OpenSSL configuration or library files in a hardcoded filesystem path that is absent from default installations and resides in a location writable by all authenticated users. The root cause is CWE-427 (Uncontrolled Search Path Element): Konga loads OpenSSL from a fixed, predictable path without verifying the integrity or provenance of files found there, enabling a classic library-planting attack. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in version 2.1.0.
Privilege escalation in Rockwell Automation FactoryTalk® Activation Manager exposes authenticated local Windows users to full SYSTEM-level access by exploiting visible console windows spawned by the installer's custom actions during installation or repair operations. Any low-privileged user present on the machine during an install or repair sequence can interact with these unprotected, SYSTEM-privileged console windows to launch an unrestricted command shell. No public exploit has been identified at time of analysis, but the attack technique - console window hijacking during elevated installer operations - is a well-documented Windows privilege escalation class requiring minimal skill once the precondition is met.
Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.
Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29.0 to conduct HTTP Request Smuggling by sending headers with whitespace before the colon - a malformed construct the server silently discarded rather than rejecting as mandated by RFC 7230 Section 3.2.4. When inets is deployed behind a front-end proxy or load balancer that interprets such headers differently, the resulting parsing discordance creates a desynchronized request boundary exploitable for session hijacking, authentication bypass, or cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches are available across all three affected OTP release branches.
HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arbitrary HTTP headers and poison request pipelines in deployments fronted by a reverse proxy. The root cause is a longstanding absence of obs-fold support: any CRLF followed by a whitespace octet (SP or TAB) is silently parsed as a new header rather than a header continuation, causing proxy-backend disagreement on request boundaries. Affected versions span OTP 17.0 through the patched releases (27.3.4.17, 28.5.0.6, 29.0.6), with vendor patches now available via the Erlang GitHub security advisory. No public exploit code or CISA KEV listing exists at time of analysis.
Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Length-preferring reverse proxy: inets frames the request body by chunked Transfer-Encoding and silently discards a co-present Content-Length header, while the front-end proxies request boundaries by Content-Length, producing a classic CL.TE desync. An unauthenticated network attacker in this topology can inject a crafted prefix into a subsequent victim's HTTP request, potentially enabling session hijacking, credential theft, or cache poisoning against other users of the same back-end. No public exploit has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and vendor patches are available for the OTP 27.x, 28.x, and 29.x release branches.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated low-privilege operator to exploit business logic flaws in the product API, obtaining elevated privileges and modifying system settings beyond their authorized scope. The CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N) reflects that exploitation is network-accessible, low-complexity, and requires only a valid operator credential. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential leakage in Kyverno's apiCall service mode automatically forwards the Kubernetes admission controller's ServiceAccount bearer token to any external HTTP endpoint referenced in a policy, including attacker-controlled servers. Affecting Kyverno before 1.16.4 (fix version disputed - see confidence notes), this insecure-by-default behavior requires only policy-creation privileges to exploit: a low-privileged user crafts a ClusterPolicy pointing apiCall.service.url at an attacker-controlled host, then triggers a matching admission event, causing Kyverno to self-exfiltrate its SA token. No public exploit is confirmed in CISA KEV, but a working proof-of-concept with full reproduction steps is embedded in the GitHub security advisory GHSA-8wfp-579w-6r25.
Server-side request forgery in Kyverno's Kubernetes admission controller (all versions before 1.18.0) enables any authenticated cluster user to redirect the admission controller's privileged HTTP client to cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), internal ClusterIP services, and loopback addresses by injecting malicious URLs through JMESPath variable substitution in ClusterPolicy `apiCall.service.url` definitions. Critically, this is non-blind SSRF: response bodies are reflected back to the attacker through admission error messages visible in kubectl output, enabling direct credential and data exfiltration in a single API call. A fully functional proof-of-concept is published in GHSA-qr4g-8hrp-c4rw; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Cross-site request forgery exposure in HPE AOS-CX switch web management interface enables remote unauthenticated attackers to force arbitrary administrative actions against the switch by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerability is partial - only "some sessions" within the management interface lack CSRF token enforcement, suggesting inconsistent protection coverage rather than a complete absence. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary OS command execution in HPE Networking Fabric Composer allows an unauthenticated attacker on an adjacent network segment to run arbitrary commands on the underlying host, achieving full system compromise. Exploitation depends on preconditions outside the attacker's direct control, which constrains practical risk and drives the AC:H rating despite the severity of the impact. No public exploit or active exploitation has been identified at time of analysis; HPE has published a security bulletin (hpesbnw05133en_us) addressing this issue.
Unauthenticated file disclosure in Erlang/OTP's inets httpd allows remote attackers on case-insensitive filesystem deployments to read files inside mod_auth-protected directories by requesting them with differently-cased path segments. The flaw spans OTP 17.0 through 29.x (inets 5.10 through 9.7.x) and stems from mod_auth's path-matching regex omitting the caseless flag, causing authentication checks to be silently bypassed when request path casing differs from the configured directory name while the filesystem resolves both to the same file. No public exploit code or active exploitation has been identified at time of analysis, and deployments on case-sensitive filesystems - the default on Linux - are fully unaffected by this vulnerability.
Authentication bypass in Erlang/OTP inets httpd allows remote unauthenticated attackers to read files inside mod_auth-protected directories across OTP 17.0 through 29.0 by prefixing the request URI with an extra slash. The inets URI normalizer preserves doubled slashes that RFC 3986 dot-segment removal does not collapse, causing mod_auth's directory-protection regex to silently fail to match while the OS transparently serves the protected file. No CISA KEV listing or public exploit code has been identified at time of analysis; CVSS 4.0 scores this 8.2 with high confidentiality impact contingent on mod_auth being explicitly configured.
Privilege escalation in Kibana allows an authenticated user holding workflow edit permissions to cause scheduled workflow executions to run under the privileges of a higher-privileged user, granting unauthorized read and write access to data outside their authorization scope. The flaw (CWE-863, Incorrect Authorization) stems from Kibana's workflow scheduling subsystem failing to enforce authorization boundaries when executing scheduled jobs - a pattern classified under CAPEC-180. No public exploit exists at time of analysis, but the CVSS 8.3 (High) score with a network-accessible, low-privilege attack vector reflects genuine impact for any multi-user Kibana deployment. Elastic's advisory ESA-2026-61 references Kibana 9.4.3 as the fix release.
The BEAM runtime in Erlang/OTP crashes when a remote attacker sends a crafted packet to any exposed TCP port using the inet driver with {packet,4} framing, exploiting a signed integer overflow in packet length calculation inside packet_parser.c and inet_drv.c. Affected deployments span OTP release lines 17 through 29, with vendor-released patches available (27.3.4.17, 28.5.0.6, and 29.0.6); no active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis. The vendor explicitly characterizes remote code execution as 'extremely unfeasible,' making denial-of-service via VM crash the realistic worst-case impact.
Unbounded memory exhaustion in the Erlang/OTP inets httpc HTTP client allows any server the client connects to - including via redirect or man-in-the-middle - to crash the BEAM VM by returning an arbitrarily large volume of response headers. The root cause is that max_header_size defaults to the atom nolimit and the header accumulation loop in httpc_response:parse_headers/6 collects all header data into an in-process list before any size check fires. A proof-of-concept server delivering 100,000 headers of ~4,000 bytes each consumed over 13 GB of RAM in under 30 seconds; no public exploit code has been separately released but the PoC is embedded in the official advisory, and vendor patches are available for OTP 27, 28, and 29 branches.
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
Unauthenticated BEAM atom table exhaustion in ash_typescript 0.11.0-0.17.x allows a remote attacker to abort the Erlang VM and take down the entire application node by sending RPC requests carrying many distinct, unrecognized field names targeting a typed struct field selector. The root cause is `resolve_typed_struct_field/2` calling `String.to_atom/1` on unresolvable client input before any field-existence validation, permanently minting atoms that the BEAM runtime never reclaims. A vendor-released patch is available in 0.18.0; no public exploit code or CISA KEV listing exists at time of analysis.
SSRF in GitHub Enterprise Server (all versions prior to 3.22) allows unauthenticated network attackers to force the Manage API to issue gateway-to-agent requests toward an attacker-controlled host, and - by intercepting those outbound requests - capture a weakly-scoped HMAC token replayable against privileged management agent endpoints. The flaw arises from an unauthenticated cluster-configuration parsing endpoint combined with an HMAC scheme that signs only a timestamp, leaving request paths and bodies unsigned and the captured token replayable with arbitrary content. Vendor-released patches are available across five supported branches (3.17.19, 3.18.13, 3.19.10, 3.20.6, 3.21.4); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote exploitation of an API endpoint in HPE Networking Fabric Composer can cause high-impact denial of service requiring manual administrator intervention, along with limited unauthorized modifications to the underlying operating system. The CVSS 8.2 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms no authentication, no special conditions, and network-level accessibility with no user interaction required. No public exploit code or active exploitation is confirmed at time of analysis, but the management-plane targeting makes this a remediation priority for organizations running HPE fabric orchestration infrastructure.
Field policy enforcement in ash_typescript RPC serialization is bypassed by a missing pattern-match clause, allowing unauthenticated remote callers to receive the real values of attributes that Ash field policies explicitly denied. Any action returning an embedded resource through the RPC layer exposes policy-protected fields - including sensitive PII such as SSNs, as demonstrated in the patch test suite - inside the serialized JSON response. Affects ash_typescript 0.11.0 through 0.17.x; no public exploit code exists at time of analysis, but the attack path is fully described in the vendor advisory and the two-line fix diff.
Authentication bypass in HPE AOS-CX switch operating system allows an adjacent unauthenticated attacker, under high-complexity conditions, to circumvent authentication controls and achieve both integrity compromise and sensitive information exposure. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond the directly targeted switch - relevant in networked environments where a compromised switch becomes a pivot point. No public exploit code or CISA KEV listing is present at time of analysis.
Unauthenticated remote command execution in HPE Networking Fabric Composer's API allows a network-accessible attacker to run arbitrary commands on the underlying operating system, resulting in complete host compromise. Exploitation requires certain preconditions outside the attacker's control (reflected in AC:H), but no authentication is needed once those conditions are satisfied. No public exploit has been identified at time of analysis; HPE has published a security bulletin addressing the issue.
Privilege escalation via an unauthenticated API endpoint in HPE Networking Fabric Composer allows a remote attacker to obtain administrative privileges and achieve complete compromise of the Fabric Composer host. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exploitation, though AC:H indicates a non-trivial exploitation condition such as a race, specific request sequence, or transient configuration state. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Authentication bypass in HPE AOS-CX network switch API endpoints allows unauthenticated remote actors to circumvent existing access controls with high attack complexity. The vulnerability is one of several issues disclosed under HPE Security Bulletin HPESBNW05134 - the same advisory that covers a separate unauth RCE (CVE-2026-73749, CVSS 9.8) and an authenticated command injection (CVE-2026-73766, CVSS 7.2) in AOS-CX. Successful exploitation could grant an attacker unauthorized administrative access to switch configuration and management functions, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Cross-tenant data exposure and modification in Grashjs Atlas CMMS prior to v1.6.0 allows any authenticated user to read and overwrite another tenant's company profile by substituting a numeric ID in the /company/{id} REST endpoint. The application's CompanyController and CompanySettingsController accepted arbitrary object IDs without verifying that the resolved object belonged to the requesting user's own tenant, enabling full cross-tenant confidentiality breach (C:H) and unauthorized data modification (I:H). No public exploit is identified at time of analysis, but the attack is trivially repeatable by any authenticated user given the predictable sequential integer ID scheme.
Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per CVSS PR:N) to bypass the denylist introduced to fix CVE-2018-1000130 by supplying alternative LDAP-scheme JMX service URLs - such as ldaps:// or LDAP URLs with a non-empty host component - that are not matched by the existing regex filter. Once accepted, the Jolokia agent JVM resolves a JNDI lookup against an attacker-controlled LDAP endpoint, enabling server-side request forgery, forwarding of in-flight JMX credentials to the attacker, and - depending on JVM classpath and security-manager configuration - remote code execution. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the bypass of a prior known CVE fix elevates realistic risk above the AC:H score alone implies.
Signature verification bypass in the HPE AOS-CX command line interface allows an authenticated administrator to execute arbitrary code on the underlying operating system when unspecified environmental pre-conditions are satisfied. The CVSS Scope:Changed metric confirms that successful exploitation escapes the AOS-CX management boundary, granting high confidentiality and integrity access to the underlying host OS. No public exploit is identified at time of analysis, and the combination of required local access, administrative credentials, and externally uncontrolled pre-conditions substantially limits opportunistic or remote exploitation.
Improper link resolution in the Backblaze Client for Windows allows a local user to render a system unbootable by creating a junction or symbolic link from Backblaze's backup folder to critical Windows OS system files, which the backup process then processes without adequate validation. The vulnerability is scoped to Windows deployments where specific OS-level security controls have been disabled through an administrator-level change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation in HPE Networking Fabric Composer allows an attacker with low-level local access to execute arbitrary code with root privileges on the host operating system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local foothold with minimal privileges - no user interaction or elevated rights needed beyond initial system access. No public exploit code or CISA KEV listing has been identified at time of analysis; however, HPE has published a security bulletin acknowledging the issue.
Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) indicates a local, low-complexity exploit path yielding full triad compromise - consistent with classic unsafe deserialization primitives that reconstruct attacker-controlled object graphs. No public exploit or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, tamper with data, and disclose sensitive information. The vulnerability (CWE-502) exists in the Megatron Bridge component of NVIDIA's large-scale model training infrastructure, where attacker-controlled serialized input is processed without adequate validation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low-privilege access to achieve code execution, data tampering, and information disclosure on the host system. The vulnerability (CWE-502) is exploitable locally without user interaction, making it particularly relevant in multi-tenant high-performance compute environments where Megatron Bridge is used for large-scale model training pipelines. No public exploit code or active exploitation has been identified at time of analysis, but the full C/I/A impact triad elevates the urgency for affected deployments.
Local code execution in NVIDIA Megatron Bridge exploits unsafe deserialization of attacker-controlled data, allowing a low-privileged local user to achieve full process compromise with high confidentiality, integrity, and availability impact. The CVSS 7.8 (High) vector - AV:L/AC:L/PR:L/UI:N - confirms that no network exposure, user interaction, or elevated privileges are required beyond an initial local foothold. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE-capable impact class warrants prompt remediation in multi-user AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes affected systems to code execution, data tampering, and information disclosure by a local low-privileged attacker. The flaw (CWE-502) allows a maliciously crafted serialized object to hijack the application's deserialization routine, granting the attacker the full CIA impact of the process context without requiring elevated privileges or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the high CIA impact and low attack complexity make this a meaningful priority for any organization running Megatron Bridge in multi-tenant or shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local user to achieve arbitrary code execution, data tampering, and information disclosure on the affected host. Reported directly by NVIDIA PSIRT (psirt@nvidia.com) and classified CWE-502, the flaw requires only local system access with standard user privileges, elevating insider threat and lateral-movement risk in shared AI training environments. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and full C/I/A impact make patching a real operational priority for any deployment.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full CIA impact from a local, low-complexity attack requiring no user interaction, making this a meaningful privilege escalation and code execution risk in shared compute environments such as multi-tenant GPU training clusters. No public exploit code or CISA KEV listing has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, corrupt data, and exfiltrate sensitive information. The vulnerability (CWE-502) is exploitable locally with low privileges and no user interaction, yielding a CVSS 7.8 High rating with full confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes local users to code execution, data tampering, and information disclosure. An attacker with low-privileged local access can supply crafted serialized payloads to the Bridge component, which are deserialized without adequate validation. No public exploit code or active exploitation has been identified at time of analysis, but the high C/I/A impact and low-complexity exploitation path make this a meaningful risk in multi-tenant AI training environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge exposes systems to local code execution, data tampering, and information disclosure from a low-privileged local user. The vulnerability (CWE-502) allows an attacker with local access to supply malicious serialized payloads that the bridge processes without sufficient validation. No public exploit or CISA KEV listing is identified at time of analysis, but the full-triad high-impact CVSS score (C:H/I:H/A:H) signals severe post-exploitation potential on any host running the component.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve code execution, data tampering, and information disclosure on the host system. The CVSS:3.1 vector (AV:L/PR:L) confirms this is a local-access vulnerability targeting NVIDIA's distributed large-model training infrastructure, where a compromised or malicious low-privileged user on the same host could supply a crafted serialized payload to the Bridge component. No public exploit or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) makes this a meaningful threat in multi-tenant AI training cluster environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local attacker with low privileges to achieve full system compromise, including arbitrary code execution, data tampering, and information disclosure. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) confirms that exploitation requires local access with minimal privilege but no user interaction, making it a realistic threat in multi-tenant AI training environments where Megatron Bridge is used. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve arbitrary code execution, tamper with data, and disclose sensitive information on the affected host. The CVSS 7.8 score with local attack vector and low-privilege requirement indicates an authenticated local user can exploit the flaw without user interaction, fully compromising confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis, though the CIA triad is fully impacted on successful exploitation, making this a meaningful risk in shared compute environments.
Deserialization of untrusted data in NVIDIA Megatron Bridge enables a local low-privileged attacker to achieve code execution, data tampering, and information disclosure with no user interaction required. The AV:L/PR:L CVSS vector confines the attack to actors who already hold a valid local account on the affected host, limiting but not eliminating real-world risk in shared AI infrastructure. No public exploit code has been identified, and this vulnerability has not been listed in CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a local low-privileged attacker to achieve code execution, data tampering, and information disclosure on the affected system. The CVSS vector (AV:L/PR:L) confirms exploitation requires local access with standard user privileges, making this most relevant to shared multi-user HPC or AI/ML training cluster environments where multiple users interact with the same Megatron infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Deserialization of untrusted data in NVIDIA Megatron Bridge allows a low-privileged local attacker to achieve arbitrary code execution, data tampering, and information disclosure on affected systems. The flaw (CWE-502) requires only an authenticated local OS session - no elevated privileges or user interaction - making it exploitable by any standard user on a host running the Bridge component. Reported directly by NVIDIA PSIRT, no public exploit has been identified at the time of analysis.