CVE-2026-65118

Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux Enabling Disclosure, Tampering, and Denial of Service

View on CVE.org
Published Sep 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

Analysis

AI-generated

Technical impact

NVIDIA Infrastructure Controller for Linux contains a flaw that causes the system to skip proper certificate validation. If an attacker exploits this, they could read sensitive data, alter communications, or disrupt the controller’s operation.

Affected Systems

The affected vendor is NVIDIA and the product is the NVIDIA Infrastructure Controller for Linux. No specific version details are provided, so any installed instance could be affected until confirmed otherwise.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is not available, so the likelihood of exploitation is uncertain. This weakness is not listed in CISA KEV. The threat is likely remote, as improper certificate validation is commonly abused by attackers who can supply rogue certificates to an otherwise trusted service, enabling interception, tampering or denial of service.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Ensure the NVIDIA Infrastructure Controller is updated to the latest firmware or software that incorporates a proper certificate validation fix; consult the vendor’s security advisory for the specific patch.
  • Configure the controller to reject untrusted or self‑signed certificates by enforcing strict TLS/SSL validation and maintaining an up‑to‑date trusted CA store.
  • Restrict network access to the controller to trusted networks only, monitor for handshake failures or attempts to supply invalid certificates, and isolate management interfaces from exposure to untrusted networks.

Generated by OpenCVE AI on September 22, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Nvidia infra Controller
CPEs cpe:2.3:a:nvidia:infra_controller:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Nvidia infra Controller
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Nvidia
Nvidia infrastructure Controller
Vendors & Products Nvidia
Nvidia infrastructure Controller
Type Values Removed Values Added
Title Improper Certificate Validation in NVIDIA Infrastructure Controller for Linux Enabling Disclosure, Tampering, and Denial of Service
Type Values Removed Values Added
Description NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L'}
Weaknesses
  • CWE-295

    Improper Certificate Validation

Sources

Status
PUBLISHED
Assigner
nvidia
Published
Updated
Sep 22, 2026, 3:07 PM
Reserved
Jul 21, 2026, 5:12 PM

View source JSON

Updated
Sep 22, 2026, 2:59 PM

JSON

Status
Analyzed
Published
Sep 22, 2026, 3:17 PM
Modified
Sep 29, 2026, 6:50 PM

View source JSON

No data.

Updated
Sep 22, 2026, 7:14 PM

JSON