NVIDIA’s September 2026 security bulletin for Triton Inference Server is rated Critical and covers two Linux vulnerabilities. They have different affected version ranges and different vendor-listed update versions: CVE-2026-16497 is fixed in 26.07, while CVE-2026-47625 is fixed in 26.04. Operators should check the version actually deployed and use NVIDIA’s bulletin to determine the applicable update path.
Which Triton vulnerabilities did NVIDIA disclose?
NVIDIA published Security Bulletin 5875, “NVIDIA Triton Inference Server – September 2026,” on September 8, 2026. NVIDIA’s Product Security index rates the bulletin Critical and lists CVE-2026-16497 and CVE-2026-47625. The bulletin applies to NVIDIA Triton Inference Server for Linux.
| CVE | NVIDIA’s description and potential impact | Affected versions | Updated version listed by NVIDIA |
|---|---|---|---|
| CVE-2026-16497 | Excessive iteration; successful exploitation might cause denial of service. | 0.0–26.06 | 26.07 |
| CVE-2026-47625 | Missing authorization; successful exploitation might lead to information disclosure, data tampering, and denial of service. | 0.0–26.03 | 26.04 |
These are the version labels and ranges NVIDIA gives in its September 2026 bulletin. The CVEs have separate ranges and fixes; do not treat either update version as the shared threshold for both.
What should Triton operators do?
- Inventory deployments. Identify every Linux Triton Inference Server instance, including containerized deployments, and record the version label shown for each deployed image or server.
- Compare versions with each CVE’s range. Use the table above and NVIDIA’s bulletin guidance to determine which vulnerability applies and the vendor-listed updated version.
- Follow NVIDIA’s update guidance. The bulletin directs readers to the updated versions for mitigations. Check the vendor’s instructions for the appropriate update path for your deployment rather than assuming a label alone specifies the upgrade procedure.
- Track vendor advisories. NVIDIA’s Product Security page recommends following bulletin update or mitigation guidance and provides an option to receive future bulletin notifications.
How do bulletin versions relate to current Triton releases?
NVIDIA’s 26.09 Triton release notes identify container release 26.09 as Triton server version 2.73.0. NVIDIA says the Triton container is available on NGC and the project is open source on GitHub; see the 26.09 release notes.
#1 Best Overall
- AI Performance: 767 AI TOPS
- OC mode: 2632 MHz (OC mode)/ 2602 MHz (Default mode)
- Powered by the NVIDIA Blackwell architecture and DLSS 4
- Axial-tech fan design features a smaller fan hub that facilitates longer blades and a barrier ring that increases downward air pressure
- A 2.5-slot design maximizes compatibility and cooling efficiency for superior performance in small chassis
The bulletin’s updated-version labels, 26.07 and 26.04, should not be assumed to map directly to a particular server binary version. Release labels and server version numbers are distinct in NVIDIA’s documentation. Verify the version of the deployment you run and consult the security bulletin for the applicable update instructions.
What is known about exploitation?
NVIDIA describes potential impacts and provides update guidance, but the cited bulletin does not establish that either vulnerability has been exploited in the wild or state how many deployments are affected. The CVSS 3.1 rows in the detailed advisory show 7.5 and HIGH for the individual issues, while the Product Security index marks the overall bulletin Critical. These are different rating fields, not conflicting labels; NVIDIA cautions that its risk assessment averages across diverse installed systems and might not reflect a specific configuration.
Quick Recap
Best Value
- Powered by the NVIDIA Blackwell architecture and DLSS 4 OC mode: 2640MHz/Default mode: 2610MHz (Boost Clock)
- Military-grade components deliver rock-solid power and longer lifespan for ultimate durability
- Protective PCB coating helps protect against short circuits caused by moisture, dust, or debris
- 3.125-slot design with massive fin array optimized for airflow from three Axial-tech fans
- Phase-change GPU thermal pad helps ensure optimal thermal performance and longevity, outlasting traditional thermal paste for graphics cards under heavy loads
Rank #4
- Powered by the NVIDIA Blackwell architecture and DLSS 4
- Powered by GeForce RTX 5060
- Integrated with 8GB GDDR7 128bit memory interface
- PCIe 5.0
- WINDFORCE cooling system
Rank #3
- Powered by the NVIDIA Blackwell architecture and DLSS 4. System Requirements: Minimum 850W PSU with 16-pin 12V-2x6 (12VHPWR) connector required. Verify before purchasing.
- Military-grade components deliver rock-solid power and longer lifespan for ultimate durability. Compatibility: 348mm (13.7") length, 3.6 slots, 4.3 lbs. Confirm case clearance and slot spacing. GPU bracket included.
- Protective PCB coating helps protect against short circuits caused by moisture, dust, or debris
- 3.6-slot design with massive fin array optimized for airflow from three Axial-tech fans
- Phase-change GPU thermal pad helps ensure optimal thermal performance and longevity, outlasting traditional thermal paste for graphics cards under heavy loads
Rank #2
- Powered by the NVIDIA Blackwell architecture and DLSS 4
- Powered by GeForce RTX 5070 Ti
- Integrated with 16GB GDDR7 256bit memory interface
- PCIe 5.0
- WINDFORCE cooling system
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.
