What is the CVSS score of CVE-2026-65127?

CVE-2026-65127 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

NVIDIA Infrastructure Controller CVE-2026-65127

EUVD-2026-84413 MEDIUM

Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258)

2026-09-22 nvidia

GHSA-h3f4-cmv7-hvgw

Information Disclosure Linux Nvidia Infrastructure Controller

4.9

CVSS 3.1 · NVD

Severity by source

Vendor (nvidia) PRIMARY

MEDIUM

qualitative

NVD

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.1 MEDIUM

Local-only debug-artifact exposure requiring existing high privilege (AV:L, PR:H) and dependent on uncleared data being present (AC:H); confidentiality-only, so I:N/A:N.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Sep 29, 2026 - 18:52 NVD

4.4 (MEDIUM) 4.9 (MEDIUM)

CVSS changed

Sep 29, 2026 - 18:22 NVD

4.1 (MEDIUM) 4.4 (MEDIUM)

Metadata Corrected

Sep 22, 2026 - 15:40 vuln.today

tag: Linux added

Analysis Generated

Sep 22, 2026 - 15:24 vuln.today

DescriptionNVD

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Information disclosure in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets a locally authenticated attacker who already holds high privileges read sensitive system information that remains in memory or logs because debug data was not cleared. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N (4.1), meaning the attacker must already have local access and high privileges, and exploitation additionally depends on uncleared debug artifacts actually being present - a condition outside the attacker's direct control. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires LOCAL access to a host running NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) AND pre-existing HIGH privileges on that host (PR:H). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a low-priority, low-real-risk issue despite a moderate 4.1 CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch identified at time of analysis from the provided data - the references link only to the CVE records and the NVIDIA product-security page (https://github.com/NVIDIA/product-security/tree/main/2026/5879), which should be checked for the current fixed release covering versions 0 through 1.9, as no version number is stated in the input. … Detailed patch versions, workarounds, and compensating controls in full report.