CVE-2026-65086
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit might lead to code execution, information disclosure, and data tampering.
Risk Assessment
The risk for the organization is the potential for remote code execution, which could lead to full system compromise, as well as information disclosure and data tampering.
Recommendation
It is recommended to immediately apply patches from NVIDIA and restrict access to OpenShell to trusted users only. Also monitor logs for suspicious commands.
Other vulnerabilities in NVIDIA OpenShell
See all- CVE-2026-65093Critical
NVIDIA OpenShell for Linux contains a vulnerability that could allow an attacker to escape the sandbox. Successful exploitation might lead to code execution, privilege escalation, data tampering, and information disclosure.
- CVE-2026-65083Critical
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disallowed inputs. Successful exploitation might lead to code execution, privilege escalation, information disclosure, data tampering, and denial of service.
- CVE-2026-65091High
NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- CVE-2026-65085Medium
NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping of output. A successful exploit might lead to information disclosure and data tampering.
Original NVD description (English source)
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.