InfoSecBulletin Cybersecurity for mankind
NVIDIA has revealed a big flaw with its BlueField DPUs and ConnectX networking systems. This issue could let attackers run code on these systems if they take advantage of it. This security flaw, known as CVE-2026-65094, affects the VIRTIO-Net part and has a CVSS v3.1 score of 9.0, showing it is a big risk for businesses and cloud setups.
NVIDIA‘s July 2026 security notice says the BlueField-3 Virtio-Net has a CWE-123 write-what-where problem. This lets a bad actor change memory by writing random data to wrong places.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
This type of weakness is very risky because it can let an attacker run their own code, which could harm the security and privacy of the systems involved.
NVIDIA BlueField Vulnerability
The attack plan shows a virtual machine (VM) user with few rights sending a harmful message to take advantage of a weakness. Because the attack method is nearby and does not need user action, it can happen in shared spaces, like cloud systems or virtual data centers.
The vulnerability also includes a scope change. This means that exploiting it could impact other resources besides the first compromised part, making it more serious in real-world settings.
Security experts say BlueField DPUs are often used to take networking, storage, and security jobs off host CPUs. This makes them important parts of today’s data center setups.
A good compromise here could help attackers get around regular security measures, spread across different tasks, or mess up network traffic.
This increases the danger for companies that depend a lot on NVIDIA networking tools for fast computing and cloud-based settings. The weakness impacts several versions of NVIDIA VIRTIO-Net, including both regular and long-term support versions.
All versions before 25.10.6 for VIRTIO-Net GA, 25.10.2 for LTS25, 24.10.50 for LTS24, and 23.10.23 for LTS23 have issues. NVIDIA has put out updates to fix the problem and strongly advises companies to update right away to avoid potential risks.
NVIDIA said that its risk assessment is an average from different uses and might not show the risk levels in specific places.
Organizations should check their infrastructure, especially if untrusted virtual machines or users can access shared network resources. NVIDIA found this vulnerability within its own systems, and as of the disclosure date, there are no reports of it being actively exploited.
Security teams need to focus on fixing write-what-where vulnerabilities because they are serious and have been used in real attacks.
Users can get the latest news from NVIDIA’s product security site and DOCA VIRTIO-Net distribution channels. To lower the risk of problems, it is a good idea to install patches, limit access to untrusted VMs, and watch for strange network activity as part of a defense plan.
