CVE-2026-47480: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-47480 is an uncaught exception vulnerability in NVIDIA Triton Inference Server for Linux that allows a remote, unauthenticated attacker to trigger a denial of service condition. It affects all versions of Triton Inference Server from 0.0 through 26.04 (inclusive). The CVE was received from NVIDIA Corporation on July 14, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) by NVIDIA (CVE Record).

The vulnerability is classified as CWE-248 (Uncaught Exception), meaning the application fails to properly handle or catch an exception condition that an attacker can deliberately trigger. Because the attack vector is network-accessible, requires no privileges, no user interaction, and has low attack complexity, the flaw can be exploited remotely by sending crafted requests to the Triton Inference Server that induce an unhandled exception, causing the server process to crash or become unavailable. No detailed technical write-up or public proof-of-concept code has been published at this time (CVE Record).

Successful exploitation results in a denial of service against the affected Triton Inference Server instance, with high availability impact and no confidentiality or integrity impact. Because Triton Inference Server is commonly used to serve AI/ML inference workloads in production environments, an outage could disrupt dependent applications and services. The scope is limited to the affected server instance, with no evidence of lateral movement or data exposure risk based on currently available information (CVE Record).

NVIDIA has identified all Triton Inference Server versions from 0.0 through 26.04 as affected. Users should monitor the official NVIDIA Product Security page for a patched release and apply updates as soon as they become available. In the interim, organizations should restrict network access to Triton Inference Server endpoints using firewalls or network segmentation, limiting exposure to trusted clients only. No specific workaround has been publicly documented by NVIDIA at this time (CVE Record).