Is CVE-2026-53805 actively exploited?

No active exploitation of CVE-2026-53805 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-53805 be exploited remotely?

Yes. CVE-2026-53805 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-53805?

CVE-2026-53805 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2026-53805

CRITICAL

CVE-2026-53805

CWE-502Published: June 17, 2026· Updated: Jun 22, 2026

9.8

CVSS v3.1

Official Description

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port to achieve remote code execution as the inference process.

NVD Source

Technical Analysis

CVE-2026-53805 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.