What is the CVSS score of CVE-2026-24252?

CVE-2026-24252 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Nemo Framework are affected by CVE-2026-24252?

NVIDIA NeMo on Linux contains an OS command injection vulnerability that allows a local authenticated attacker to fully compromise the system, gaining code execution, privilege escalation, and data…

How to fix or mitigate CVE-2026-24252?

Within 24 hours, restrict local access to NVIDIA NeMo systems to only trusted users via tightened group policies and multi-factor authentication; disable unnecessary local accounts. Within 7 days, deploy endpoint detection and response (EDR) rules to monitor for anomalous command execution, especially through NeMo processes, and implement application control policies to limit execution to approved binaries. Within 30 days, evaluate and deploy a sandboxing or containerization solution for NeMo workloads to isolate processes, and engage NVIDIA for patch notifications; consider compensating controls such as SELinux or AppArmor profiles to restrict the NeMo service's ability to execute arbitrary commands.

Nemo Framework CVE-2026-24252

EUVD-2026-49370 HIGH

OS Command Injection (CWE-78)

2026-07-27 nvidia

GHSA-3v7c-g8p3-w3h6

RCE Information Disclosure Command Injection Nvidia Nemo Framework

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (nvidia) · only source for this CVE.

CVSS VectorVendor: nvidia

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 17:31 vuln.today

CVE Published

Jul 27, 2026 - 16:41 cve.org

HIGH 7.8

DescriptionCVE.org

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code execution, data tampering, escalation of privileges and information disclosure.

AnalysisAI

OS command injection in NVIDIA NeMo for Linux allows a local authenticated attacker to execute arbitrary commands, leading to full system compromise (code execution, privilege escalation, data tampering, and information disclosure). No public exploit code or active exploitation has been identified at the time of analysis.