Is CVE-2026-24209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24209 being exploited in the wild.

How severe is CVE-2026-24209?

High severity, with a CVSS score of 7.5, published 20 May 2026.

Is there a fix for CVE-2026-24209?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24209 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24209?

Check whether you run Nvidia Triton Inference Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24209: NVIDIA Triton Inference Server path traversal in service endpoint

CVE-2026-24209 · Severity: high · CVSS 7.5 · Published 2026-05-20

NVIDIA Triton Inference Server, a platform used to deploy and manage AI models in production, is affected by a path traversal vulnerability. An unauthenticated attacker can exploit this flaw over the network to disrupt the server's operations. This could lead to a denial-of-service condition, preventing legitimate users and applications from accessing AI inference services.

Technologies: Nvidia Triton Inference Server. Vendors: Nvidia.

Quick answers

Is CVE-2026-24209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24209 being exploited in the wild.
How severe is CVE-2026-24209?: High severity, with a CVSS score of 7.5, published 20 May 2026.
Which products and versions are affected?: NVIDIA Triton Inference Server.
Is there a fix for CVE-2026-24209?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24209 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24209?: Check whether you run Nvidia Triton Inference Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in NVIDIA Triton Inference Server. The flaw allows an unauthenticated remote attacker to provide specially crafted input that bypasses directory restrictions. According to the CVSS vector, the attack is low complexity and requires no user interaction or privileges. Successful exploitation results in a high impact on availability, potentially crashing the service or making it unresponsive (Denial of Service). While the vulnerability is categorized as path traversal, the reported impact is limited to availability rather than data confidentiality or integrity.

Affected products

NVIDIA Triton Inference Server

Timeline

2026-05-20: advisory: Initial disclosure by NVIDIA and NVD publication.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.