Exploitation timeline
Threadlinqs has recorded 35 NVIDIA CVEs published between and . The busiest month was 2026-08 (33 new CVEs). None of them is listed in CISA KEV yet.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 35 of 35 tracked NVIDIA CVEs.
- CVE-2026-65091high 8.8EPSS 2.6%
- CVE-2026-65086medium 6.8EPSS 2.4%
- CVE-2026-65089high 7.8EPSS 1.3%
- CVE-2026-65090high 7.8EPSS 1.3%
- CVE-2026-65096high 7.8EPSS 1.3%
- CVE-2026-65099high 7.8EPSS 1.3%
- CVE-2026-65098high 8.1EPSS 1%
- CVE-2026-24168medium 6.8EPSS 1%
- CVE-2026-65083critical 9.9EPSS 0.9%
- CVE-2026-65093critical 9.9EPSS 0.8%
- CVE-2026-47627critical 9.8EPSS 0.7%
- CVE-2026-65092high 8.5EPSS 0.6%
- CVE-2026-47483high 8.2EPSS 0.6%
- CVE-2026-65084high 8.1EPSS 0.5%
- CVE-2026-65105high 8.1EPSS 0.5%
- CVE-2026-65081high 8.1EPSS 0.4%
- CVE-2026-24169high 8EPSS 0.4%
- CVE-2025-23351critical 9EPSS 0.4%
- CVE-2026-24170high 8.8EPSS 0.3%
- CVE-2026-65097high 7.5EPSS 0.3%
- CVE-2026-24184high 7.5EPSS 0.3%
- CVE-2026-24185high 7.1EPSS 0.3%
- CVE-2026-24167medium 6.8EPSS 0.3%
- CVE-2026-47487medium 4.4EPSS 0.2%
- CVE-2026-65082high 7EPSS 0.2%
- CVE-2026-47626high 8.2EPSS 0.2%
- CVE-2026-47624medium 6EPSS 0.2%
- CVE-2026-65088medium 5.5EPSS 0.2%
- CVE-2026-65085medium 5.2EPSS 0.2%
- CVE-2026-24263high 8.2EPSS 0.2%
- CVE-2026-24262high 8.2EPSS 0.2%
- CVE-2026-65087medium 5.6EPSS 0.2%
- CVE-2026-24225medium 6EPSS 0.1%
- CVE-2026-24183high 7.8EPSS 0.1%
- CVE-2026-24166medium 5.1EPSS 0.1%
Products affected
Threadlinqs normalises CPE and CNA product records across all 35 CVEs; 23 distinct NVIDIA products are affected. The most frequently affected (top 20):
- NemoClaw 12 CVEs
- OpenShell 6 CVEs
- DGX Spark 5 CVEs
- Unified Fabric Manager Enterprise - GA 5 CVEs
- Unified Fabric Manager Enterprise - LTS 2023 5 CVEs
- Unified Fabric Manager Enterprise - LTS 2024 5 CVEs
- Unified Fabric Manager Enterprise - LTS 2025 5 CVEs
- Cumulus Linux GA 2 CVEs
- Triton Inference Server 2 CVEs
- BlueField GA 1 CVE
- BlueField LTS22 1 CVE
- BlueField LTS23 1 CVE
- BlueField LTS24 1 CVE
- ConnectX GA 1 CVE
- ConnectX LTS22 1 CVE
- ConnectX LTS23 1 CVE
- ConnectX LTS24 1 CVE
- ConnectX-4 1 CVE
- ConnectX-4 LX 1 CVE
- Cumulus Linux LTS 1 CVE
Threat activity
9 tracked threat campaigns reference NVIDIA products or exploit NVIDIA CVEs:
- Nvidia DCGM Exporter unauthenticated denial-of-service via /debug/pprof (CVE-2026-47483)HIGH
- Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in Nvidia's NemoClaw AI Agent Stack and a CVSS 10.0 Adobe Campaign Classic ChainCRITICAL
- NVIDIA Releases SkillSpector: Open-Source Security Scanner for AI Agent SkillsLOW
- CVE-2026-65094: Write-What-Where Vulnerability in NVIDIA BlueField-3 VIRTIO-Net Enables Code ExecutionCRITICAL
- Bit2Watt: Synchronized GPU Power-Oscillation Attack Could Let Cloud Tenants Destabilize Power GridsHIGH
- Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude CodeHIGH
- LabubaRAT: Rust-based RAT Disguised as NVIDIA Container Runtime ToolkitHIGH
- Pwn2Own Berlin 2026 Day Two: Microsoft Exchange RCE-as-SYSTEM Chain and 14 Other Zero-Days DisclosedHIGH
- NVIDIA GeForce NOW Armenian Data Breach via GFN.am Alliance Partner Compromise — ShinyHunters-Branded PII TheftHIGH
Threat actors targeting NVIDIA
Named threat actors attributed to campaigns that involve NVIDIA products or CVEs, with the number of linked campaigns:
How to prioritise NVIDIA patching
This order follows the data Threadlinqs holds for NVIDIA, not a generic severity checklist:
- No NVIDIA CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are CVE-2026-65091 (2.6%), CVE-2026-65086 (2.4%), CVE-2026-65089 (1.3%).
- 4 CVEs score Critical and 21 High on CVSS v3 (maximum 9.9, average 7.5); sequence these after KEV and high-EPSS items.
- 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.