CVE-2026-47483

CVE Enrichment

CVSS: 8.2 HIGH
EPSS: 0.34%
EPSS Percentile: 24.94%
CISA KEV: Not listed

Description

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: psirt@nvidia.com
Published: 28-Jul-2026 23:18
Last Modified: 29-Jul-2026 00:16
EPSS Date: 2026-10-11
CWE: CWE-770

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:L /
                            I:N /
                            A:H

References

Last enrichment sync: 12-Oct-2026 11:12
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

graphics processing unit (GPU) servers were open to a high-severity flaw in NVIDIA’s DCGM Exporter (CVE-2026-47483) that lets unauthenticated attackers crash the monitoring service and may disrupt AI workloads, Week in Review: Active FortiBleed Attacks, Exploited Flaws and Major Breaches
Hundreds of internet-exposed GPU servers were found running vulnerable NVIDIA DCGM Exporter instances affected by CVE-2026-47483, which can be crashed by unauthenticated attackers and may disrupt AI workloads. Exposed NVIDIA DCGM Exporters vulnerable to unauthenticated crash flaw
Researchers have disclosed CVE-2026-47483, a high-severity flaw in Nvidia’s DCGM Exporter GPU monitoring tool. Cybersecurity roundup: AI-linked bank attacks, credential theft and exposed GPU monitoring flaw

CVE (5)

Malware (5)

People (7)

Threat Actors (3)

Vendors (16)

Products (21)

Tools (2)

Industries (9)

Countries (8)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.