Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-65097

CVE-2026-65097HIGH

NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without …

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0032   22.2     —

AFFECTED
  Product   Versions       Fixed
  NemoClaw  0 to 0.0.21 –  —

TIMELINE
  Jul 21  Reserved by nvidia
  Aug 25  Published (CNA: nvidia)
  Sep 1   RESCORED — CVE-2026-65097 (NVIDIA NemoClaw). CVSS 7.5 → 8.8 (NVD).

CWE-494 · CNA: nvidia · CVSS v3.1 · 3 references · NVD status: Analyzed

Description

NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without integrity check. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 21, 2026	Reserved	Reserved by nvidia
August 25, 2026	Published	Published (CNA: nvidia)
September 1, 2026	RESCORED	RESCORED — CVE-2026-65097 (NVIDIA NemoClaw). CVSS 7.5 → 8.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
NVIDIA	NemoClaw	—	0 to 0.0.21	—

Weaknesses

CWE-494

References (3)

https://github.com/NVIDIA/product-security/tree/main/2026/5872 [Patch]
https://nvd.nist.gov/vuln/detail/CVE-2026-65097 [US Government Resource]
https://www.cve.org/CVERecord?id=CVE-2026-65097 [Third Party Advisory]

Authoritative record: CVE-2026-65097 at cve.org

Vendors: nvidia

Weaknesses: CWE-494

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-65097 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.