# Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in Nvidia's NemoClaw AI Agent Stack and a CVSS 10.0 Adobe Campaign Classic Chain

> Adobe shipped seven security bulletins on August 25-26, 2026 fixing 38 vulnerabilities across Campaign Classic, Content Credentials SDK/CAI, Illustrator, Substance 3D Designer/Sampler/Painter, and XD, including three unauthenticated CVSS 10.0 Campaign Classic flaws (SSRF, two OS command injections). Separately, Nvidia's August 2026 bulletin cycle patched 33 CVEs across NemoClaw/OpenShell (18, two critical up to 9.9 — a sandbox-provisioning filter bypass and a full sandbox escape), DGX Spark firmware, Unified Fabric Manager, Cumulus Linux/NVOS, and Triton Inference Server. Neither vendor reports in-the-wild exploitation, though the NemoClaw/OpenShell flaws had a public technical write-up (DNS-rebinding attack against an unauthenticated Ollama backend) from Oasis Security prior to patch release.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-09-02T14:09:01.820Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2152
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-adobe-nvidia-august-2026-patches-tl-2026-2152.webp?v=30b70aa3 (Threadlinqs threat intel: Adobe Campaign Classic, NemoClaw Flaws: Detection & IOCs (TL-2026-2152) — Critical severity, 36 IOCs, 9 detection rules.)
- **ID:** TL-2026-2152
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 36
- **CVEs:** CVE-2026-76193, CVE-2026-76195, CVE-2026-76197, CVE-2026-71441, CVE-2026-48417, CVE-2026-48418, CVE-2026-48419, CVE-2026-48420, CVE-2026-48421, CVE-2026-48422, CVE-2026-48423, CVE-2026-48424, CVE-2026-48425, CVE-2026-71382, CVE-2026-48426, CVE-2026-48427, CVE-2026-48428, CVE-2026-48429, CVE-2026-48430, CVE-2026-48431, CVE-2026-48432, CVE-2026-48433, CVE-2026-71564, CVE-2026-75749, CVE-2026-75750, CVE-2026-75752, CVE-2026-75766, CVE-2026-75767, CVE-2026-75768, CVE-2026-75769, CVE-2026-75770, CVE-2026-71360, CVE-2026-71442, CVE-2026-71443, CVE-2026-71444, CVE-2026-76189, CVE-2026-76198, CVE-2026-71399, CVE-2026-65081, CVE-2026-65082, CVE-2026-65083, CVE-2026-65084, CVE-2026-65085, CVE-2026-65086, CVE-2026-65087, CVE-2026-65088, CVE-2026-65089, CVE-2026-65090, CVE-2026-65091, CVE-2026-65092, CVE-2026-65093, CVE-2026-65096, CVE-2026-65097, CVE-2026-65098, CVE-2026-65099, CVE-2026-65105, CVE-2026-47626, CVE-2026-24263, CVE-2026-24262, CVE-2026-47624, CVE-2026-24225, CVE-2026-24170, CVE-2026-24169, CVE-2026-24168, CVE-2026-24167, CVE-2026-24166, CVE-2026-24183, CVE-2026-24184, CVE-2026-24185, CVE-2026-47487, CVE-2026-47627, CVE-2026-48286, CVE-2026-48449, CVE-2026-48448, CVE-2026-48331, CVE-2026-48323, CVE-2026-48330, CVE-2026-48326, CVE-2026-48317, CVE-2026-48333, CVE-2026-48399

## Description

On August 25-26, 2026, Adobe and Nvidia both released large batches of security patches, prompting a consolidated SecurityWeek roundup. Adobe's cycle (its second of August 2026) covers seven products in seven APSB bulletins totaling 38 CVEs. The highest-impact issues sit in Adobe Campaign Classic (on-premise/hybrid ACC builds up to 7.4.4 build 9400): CVE-2026-76193 is an unauthenticated server-side request forgery (CWE-918, CVSS 10.0) with a changed scope, and CVE-2026-76195 / CVE-2026-76197 are unauthenticated OS command injection flaws (CWE-78, CVSS 10.0 each) — all three permit remote arbitrary code execution against internet-facing marketing-automation servers with no privileges and no user interaction. Adobe-hosted Campaign Classic instances were already remediated; on-premise/hybrid customers must patch. The remaining six Adobe bulletins are lower-severity but still numerous: Content Credentials SDK / Content Authenticity Initiative (CAI) libraries received 6 fixes for denial-of-service (uncontrolled resource consumption, integer underflow) and an arbitrary-filesystem-read flaw (CVE-2026-76198) triggered by opening a malicious asset; Substance 3D Sampler (10 CVEs), Substance 3D Designer (9 CVEs), and Substance 3D Painter (8 CVEs) all received near-identical batches of out-of-bounds-write / heap- and stack-based buffer overflow fixes (CVSS 7.8, CWE-787/CWE-122/CWE-121) that execute arbitrary code in the current user's context when a victim opens a malicious 3D asset file; Illustrator got one medium out-of-bounds-read information-disclosure fix (CVE-2026-71441); Adobe XD got one high-severity buffer overflow (CVE-2026-71399, CWE-120) requiring the victim to open a malicious file. Adobe states none of the 38 CVEs were known to be exploited or publicly disclosed prior to the fix.

Nvidia's parallel cycle patched 33 CVEs across five bulletins published August 4-25, 2026. The most severe cluster is NemoClaw (Nvidia's open-source reference deployment stack for running agents such as OpenClaw against a local Ollama inference backend inside Nvidia's OpenShell sandbox) and OpenShell itself: 18 CVEs, two of them critical (CVE-2026-65083, CVSS 9.9, an incomplete disallowed-inputs list in the OpenShell sandbox-provisioning API that lets a caller escape intended input restrictions; CVE-2026-65093, CVSS 9.9, a direct sandbox-escape vulnerability, CWE-427 uncontrolled search path element) and twelve rated high (7.0-8.8), spanning OS command injection in NemoClaw's status/logs plugin, NIM management component, Telegram bridge, and CLI (all CWE-78); untrusted code execution during installation and integrity-check bypasses in install/deployment scripts (CWE-494, CWE-295); a weak/legacy authentication mechanism in the remote-access helper workflow (CWE-1390); and unauthenticated access to the local inference service itself (CVE-2026-65105, CVSS 8.1) because NemoClaw binds Ollama to 0.0.0.0:11434 to let the OpenShell container reach it, which simultaneously disables Ollama's Host-header validation and exposes the unauthenticated Ollama API to the entire local network. Independent research published by Oasis Security in the days before the patch documented a full attack chain: an attacker-controlled webpage uses DNS rebinding to defeat the browser's same-origin policy, then calls Ollama's /api/show and /api/create endpoints to fetch and re-upload a model whose Go text/template has been poisoned with malicious rendering instructions — persistently hijacking the victim's local AI agent from a single page visit, no authentication required. Nvidia's other four bulletins are narrower: DGX Spark AI-computer UEFI/system firmware (5 CVEs, 3 high, requiring a privileged local attacker, out-of-bounds write and NULL-pointer-dereference primitives with a changed/escalated scope, CWE-787/CWE-476/CWE-693); Unified Fabric Manager (5 CVEs, 2 high including CVE-2026-24170, CVSS 8.8, an improper-authentication bypass via crafted HTTP requests to the web interface, and CVE-2026-24169, CVSS 8.0, code injection in the plugin-management API reachable by a low-privileged authenticated user, plus 3 medium command-injection/hard-coded-key issues); Cumulus Linux and NVOS (3 CVEs, all high: CWE-250 privilege escalation via the user-management component, CWE-120 LLDP-daemon buffer overflow reachable from an adjacent network, and CWE-288 authentication bypass via an alternate SSH path in PKA-only mode); and Triton Inference Server across two separate August bulletins — a medium MLflow-plugin path-traversal file-access issue (CVE-2026-47487, CVSS 4.4, fixed in 26.03) and a later critical unauthenticated path-traversal denial-of-service flaw (CVE-2026-47627, CVSS 9.8, CWE-22, affecting versions up to 26.05, fixed in 26.06). Nvidia reports no evidence of in-the-wild exploitation for any of the 33 CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1611 Escape to Host
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1557 Adversary-in-the-Middle
- T1005 Data from Local System
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1592.002 Gather Victim Host Information: Software
- T1595.002 Active Scanning: Vulnerability Scanning
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1068 Exploitation for Privilege Escalation
- T1046 Network Service Discovery
- T1090 Proxy
- T1189 Drive-by Compromise
- T1583.001 Acquire Infrastructure: Domains
- T1082 System Information Discovery
- T1518 Software Discovery
- T1485 Data Destruction
- T1499 Endpoint Denial of Service
- T1531 Account Access Removal
- AML.T0011 User Execution
- AML.T0040 ML Model Inference API Access
- AML.T0056 Extract LLM System Prompt
- AML.T0018 Backdoor ML Model

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**NemoClaw/OpenShell Sandbox Escape and Unauthenticated Ollama Model-Poisoning Chain (CVE-2026-65083/65093/65105)** (`TL-2026-2152-SPL-002`)

Detects the Oasis Security-documented attack chain: an attacker-controlled webpage abuses DNS rebinding to reach a NemoClaw host's Ollama backend (bound unauthenticated to 0.0.0.0:11434), then calls /api/show and /api/create to fetch and re-upload a Go text/template-poisoned model, persistently hijacking the local AI agent. Also flags OpenShell sandbox-provisioning filter-bypass/escape indicators (CVE-2026-65083, CVE-2026-65093, both CVSS 9.9).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1611, T1195, T1552
- **Data sources:** ollama_api_logs, openshell_sandbox_logs, linux_auditd, network_connection_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=nemoclaw OR index=ollama sourcetype IN ("ollama:api","openshell:sandbox","linux:auditd")
| eval unauth_api=if(match(_raw,"(?i)(GET|POST)\s+\/api\/(show|create|pull)\b") AND NOT match(_raw,"(?i)authorization:\s*bearer"),1,0)
| eval bind_all=if(match(_raw,"(?i)listen(ing)?\s+(on\s+)?0\.0\.0\.0:11434"),1,0)
| eval sandbox_escape=if(match(_raw,"(?i)(disallowed_inputs|sandbox.?provision|sandbox.?escape|chroot\s+bypass|search\s+path\s+element)"),1,0)
| where unauth_api=1 OR bind_all=1 OR sandbox_escape=1
| stats count as hit_count values(_raw) as sample_events earliest(_time) as first_seen latest(_time) as last_seen by src_ip, host, dest_port
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
let RebindWindow = 5m;
DnsEvents
| where TimeGenerated > ago(24h)
| summarize DistinctIPs = dcount(IPAddresses), IPs = make_set(IPAddresses) by Name, bin(TimeGenerated, RebindWindow)
| where DistinctIPs >= 2
| join kind=inner (
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where RemotePort == 11434
    | where RemoteUrl has "/api/show" or RemoteUrl has "/api/create" or RemoteUrl has "/api/pull"
) on $left.Name == $right.RemoteUrl
| project TimeGenerated, DeviceName, Name, IPs, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
```

### Sigma

```yaml
title: NemoClaw/OpenShell Sandbox Escape or Unauthenticated Ollama Exposure (CVE-2026-65083/65093/65105)
id: 9b2f7e14-3a5d-4c8e-b1f0-6d4a2c7e9f83
status: experimental
description: Detects network connections to an Ollama backend bound to 0.0.0.0:11434 with no authorization header, and OpenShell sandbox-provisioning escape indicators, matching CVE-2026-65083/65093 (CVSS 9.9 sandbox-escape class) and CVE-2026-65105 (unauthenticated Ollama exposure).
references:
  - https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html
  - https://securityboulevard.com/2026/08/oasis-security-researchers-reveal-security-flaw-in-nemoclaw-ai-agent/
author: Threadlinqs Team
date: 2026-08-26
tags:
  - attack.defense-evasion
  - attack.t1611
  - attack.t1195
  - cve.2026.65083
  - cve.2026.65093
  - cve.2026.65105
  - attack.tool.ollama
logsource:
  category: network_connection
  product: linux
detection:
  selection_bind:
    DestinationPort: 11434
    DestinationIp: '0.0.0.0'
  selection_escape:
    CommandLine|contains:
      - 'openshell'
      - 'sandbox-provision'
      - 'disallowed_inputs'
  condition: selection_bind or selection_escape
falsepositives:
  - Intentional local-network NemoClaw lab deployments with documented compensating network segmentation
level: critical
```

**Known false positives:**

- Intentional local-network NemoClaw/Ollama lab deployments that legitimately bind 0.0.0.0 behind a firewalled segment
- Internal CI pipelines re-pulling/re-creating models via the Ollama API with valid but unlogged service accounts

**Tuning notes:** Baseline which hosts are expected to run NemoClaw/Ollama and suppress bind_all alerts for hosts already network-segmented; raise severity automatically when unauth_api and bind_all co-occur on the same host within the same session.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Adobe Campaign Classic Unauthenticated SSRF / OS Command Injection Attempt (CVE-2026-76193/76195/76197) (locked: unlock with TL Creds)
- DNS-Rebinding Driven Model Poisoning Against Local Ollama Backend (CVE-2026-65105, Oasis Security Chain) (locked: unlock with TL Creds)
- Lateral Movement via UFM Authentication Bypass or Triton Path Traversal (CVE-2026-24170, CVE-2026-47627) (locked: unlock with TL Creds)
- Adobe Campaign Classic Unauthenticated SSRF or OS Command Injection Attempt (CVE-2026-76193/76195/76197) (locked: unlock with TL Creds)
- NemoClaw/OpenShell Sandbox Escape or Unauthenticated Ollama Exposure (CVE-2026-65083/65093/65105) (locked: unlock with TL Creds)
- NemoClaw Command Injection Chained with Lateral-Movement Indicators (UFM/Triton) (locked: unlock with TL Creds)
- Adobe Campaign Classic Unauthenticated SSRF / OS Command Injection Attempt (CVE-2026-76193/76195/76197) (locked: unlock with TL Creds)
- NemoClaw Command Injection Chained with UFM Auth Bypass or Triton Path Traversal (Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Adobe and Nvidia Patch Dozens of Vulnerabilities](https://www.securityweek.com/adobe-and-nvidia-patch-dozens-of-vulnerabilities/)
- [Security Bulletin: NVIDIA NemoClaw and OpenShell - August 2026](https://github.com/NVIDIA/product-security/tree/main/2026/5872)
- [Security Bulletin - NVIDIA DGX Spark - August 2026](https://github.com/NVIDIA/product-security/tree/main/2026/5867)
- [Security Bulletin: NVIDIA Unified Fabric Manager - August 2026](https://github.com/NVIDIA/product-security/tree/main/2026/5809)
- [Security Bulletin: NVIDIA Cumulus Linux and NVOS - August 2026](https://github.com/NVIDIA/product-security/tree/main/2026/5817)
- [Security Bulletin: NVIDIA Triton Inference Server - August 2026 (CVE-2026-47487)](https://github.com/NVIDIA/product-security/tree/main/2026/5860)
- [Path Traversal in NVIDIA Triton Inference Server for Linux (CVE-2026-47627)](https://mallory.ai/vulnerabilities/CVE-2026-47627)
- [A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw](https://thehackernews.com/2026/08/a-malicious-webpage-could-poison-your.html)
- [Oasis Security Researchers Reveal Security Flaw in NemoClaw AI Agent](https://securityboulevard.com/2026/08/oasis-security-researchers-reveal-security-flaw-in-nemoclaw-ai-agent/)
- [NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents With One Website Visit](https://cybersecuritynews.com/nvidia-nemoclaw-flaw/)
- [Adobe Campaign Classic CVSS 10.0: A Five-Step Check for On-Premise Admins](https://aardwolfsecurity.com/adobe-campaign-classic-vulnerability-check/)
- [CVE-2026-76193 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-76193)
- [CVE-2026-65093 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-65093)
- [Adobe behebt über 30 Schwachstellen in Illustrator, Campaign & Co](https://www.pcwelt.de/article/3220583/adobe-behebt-uber-30-schwachstellen-in-illustrator-campaign-co.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2152