NVIDIA AIStore vulnerabilities include CVSS 10.0 remote code execution

CVE-2026-65162 is a CVSS 10.0 remote code execution vulnerability in NVIDIA AIStore, part of a broader release that fixes 18 flaws across NVIDIA AI tools. The single event from securityonline.info (2026-10-13T23:56:06Z) notes unauthenticated remote exploitation potential via AIStore and urges an upgrade, but does not name the patched version or confirm active exploitation telemetry. Because the event carries no vendor advisory link, no GreyNoise or Shodan-style telemetry, and no original researcher disclosure, defenders have only the CVE score and product name to work with.

That is precisely why this story demands attention: a CVSS 10.0 RCE in an AI infrastructure component is not a routine patch item. Organizations running NVIDIA AIStore face full remote compromise of the storage layer that feeds model pipelines; the exposure is not limited to data theft but extends to model poisoning and supply-chain contamination across any workload that reads from AIStore. The event notes 18 fixes in total, which implies multiple high-severity issues in the same release cycle, increasing the probability that at least one has public proof-of-concept or active scanning within days of disclosure. Only one source has reported this so far, meaning the signal-to-noise gap is large and early defenders gain disproportionate advantage by acting before broader exploitation begins.

Upgrade to the NVIDIA release that patches CVE-2026-65162 immediately; since the event does not specify the patched version number, verify the NVIDIA security advisory directly for the exact AIStore build. Until patching is complete, restrict network access to AIStore management and data ports to known internal model-serving hosts only. Hunt for unexpected processes or outbound connections originating from AIStore nodes; the event does not list specific IoC names or log paths, so focus on generic RCE indicators such as unknown child processes of the AIStore service and anomalous connections to external IPs from AIStore hosts. Monitor NVIDIA's advisory feed for the precise version number and any subsequent exploitation confirmation.

Watch for two developments: confirmation from NVIDIA or a third party of the exact patched AIStore version, and any GreyNoise-style telemetry or KEV catalog entry showing active exploitation of CVE-2026-65162. Either would shift this from an urgent patch story to an active-response event requiring immediate containment rather than planned upgrade.