NVIDIA NemoClaw CVE-2026-65084

Exploitation requires the attacker to intercept NemoClaw's deployment-process network traffic - i.e., achieve a machine-in-the-middle position on the path between NemoClaw and the endpoint it connects to during deployment - and serve an invalid or attacker-controlled TLS certificate that the flawed validation logic accepts. The specific trigger is running the NemoClaw deployment process (versions 0 through 0.0.1 on Linux) over a network an attacker can influence; no authentication (PR:N) or user interaction (UI:N) is needed on the target side. The practical limiting factor, despite the AV:N/AC:L vector, is that CWE-295 exploitation depends on the attacker already controlling or subverting the network path, which is why CISA SSVC rates Automatable as 'no' and EPSS is only 0.32%.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects an unauthenticated, network-reachable flaw with total impact, but the signals do not all point the same direction and should be weighed carefully. CISA's SSVC framework marks Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total,' and EPSS is low at 0.32% (24th percentile) - together suggesting that although the consequences are severe, opportunistic mass exploitation is unlikely because a machine-in-the-middle position is a real prerequisite that CWE-295 flaws typically require despite an AV:N rating. That MITM prerequisite is the key nuance the raw 9.8 obscures: an attacker generally needs to already control or influence the network path used during deployment. Because a successful attack can lead to code execution and privilege escalation on the deployment host, organizations running NemoClaw should still patch promptly, but this is better characterized as a high-severity, lower-probability, path-dependent issue than an imminent worm-scale threat.

An attacker who can position themselves on the network path (e.g., on a shared LAN, compromised router, or rogue proxy) intercepts NemoClaw's deployment traffic and presents a fraudulent TLS certificate that the client fails to reject. Having established a trusted-looking channel, the attacker substitutes tampered deployment artifacts, leading to arbitrary code execution and privilege escalation on the target host. No public exploit code is identified at time of analysis, and the attack requires an active MITM foothold rather than a simple remote request.