External risk intelligence

NVIDIA Infrastructure Controller OS Command Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65130

The NVIDIA Infrastructure Controller is typically used within data center or server environments for infrastructure management. While it is network-accessible, it is not inherently designed to be public-facing, and common deployments usually position such management interfaces behind internal network controls or administrative segments.

OS Command Injection

Nvidia Infra Controller

before 2.0.0

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

NVIDIA Infrastructure Controller for Linux has a critical vulnerability allowing unauthenticated attackers to inject operating system commands remotely. This could potentially lead to code execution, data manipulation, service disruption, or unauthorized information access.

Unauthenticated remote command injection risk.
Critical flaw could compromise systems.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability through the network without needing any special access or user interaction. The vulnerability resides in the NVIDIA Infrastructure Controller for Linux, allowing an attacker to inject operating system commands. Successfully exploiting this could lead to attackers executing code, altering data, disrupting services, or accessing sensitive information.

Network accessible.
OS command injection trigger.
Code execution, data tampering risk.

Live Threat

Current exploitation, exposure, and threat context

An attacker could inject operating system commands into the NVIDIA Infrastructure Controller for Linux, potentially leading to unauthorized code execution, modification of data, service disruption, or exposure of sensitive information. This risk exists when the controller is accessible over a network without proper authentication or other protective measures.

System commands and data.
Network access without authentication.
Unauthorized code execution and data tampering.

Operational Fix

Recommended remediation, mitigation, and detection steps

NVIDIA Infrastructure Controller for Linux is likely managed by infrastructure or platform teams responsible for managing NVIDIA hardware and its supporting software. The first critical step is to identify all instances of the affected controller, determine their network exposure and business criticality, and then locate the specific system owner responsible for remediation planning and execution.

Infrastructure or Platform Teams own the issue.
Verify controller instances and network exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NVIDIA Infrastructure Controller?

The NVIDIA Infrastructure Controller is a software component used for managing NVIDIA hardware and its supporting infrastructure. It typically operates within data centers or server environments, providing administrative control over hardware resources to ensure efficient operation of computing clusters.

How does CVE-2026-65130 cause OS command injection?

This vulnerability is classified as CWE-78, or OS Command Injection. It occurs when software improperly processes input, allowing an attacker to insert and execute their own operating system commands. In the context of CVE-2026-65130, this means an unauthorized party could force the controller to run arbitrary commands on the underlying system, potentially gaining full control over that instance.

What triggers this vulnerability in the software?

An attacker triggers this bug by sending specific malicious input over the network to the NVIDIA Infrastructure Controller. No authentication or user interaction is required for the trigger to succeed. Notably, this flaw does not require the attacker to have pre-existing access to the internal network if the interface is improperly exposed; however, the vulnerability remains inactive if the controller does not receive input containing malicious command strings.

Is my environment at risk for CVE-2026-65130?

According to Halo Surface Signal, these controllers are generally intended for internal management segments rather than being public-facing. You should care if your infrastructure controllers are accidentally reachable from the broader network or internet. If your controllers are strictly isolated behind robust network controls, the immediate risk of external exploitation is significantly reduced.

What should I do if I run NVIDIA Infrastructure Controller?

Begin by identifying all running instances of the controller within your environment. Verify whether these instances are accessible from outside your internal management network. Once you have mapped your assets and their network exposure, coordinate with the infrastructure or platform teams responsible for these systems to plan and apply the necessary updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.