CVE-2026-47624 NVIDIA CVE debrief

Who should care

System administrators and security teams responsible for NVIDIA DGX Spark systems should assess exposure and prioritize patching to prevent potential local privilege escalation. They should also verify UEFI version and apply patches if available, monitor for local privilege escalation attempts, and review and update incident response plans for UEFI component vulnerabilities.

Why it matters

CVE-2026-47624 is a Medium-severity vulnerability in NVIDIA DGX Spark UEFI that allows local users to bypass administrator password protection. System administrators and security teams should assess exposure, prioritize patching, and monitor for potential exploitation attempts. The vulnerability requires verification of affected versions and exploitation status.

• Local privilege escalation requires verification
• UEFI component vulnerability assessment is necessary
• Patching and configuration changes may be required
• Monitoring for exploitation attempts is recommended

Technical summary

The vulnerability in NVIDIA DGX Spark UEFI allows a privileged local user to bypass administrator password protection. The affected version is prior to 1.110.13. The CVSS score is 6 (Medium). This vulnerability requires verification of affected versions and exploitation status. NVIDIA DGX Spark systems are affected, and patching is recommended to prevent potential local privilege escalation.

Defensive priority

Medium priority for UEFI component assessment and patching

Recommended defensive actions

• Assess exposure of NVIDIA DGX Spark systems in your environment
• Verify UEFI version and apply patches if available
• Monitor for local privilege escalation attempts
• Review and update incident response plans for UEFI component vulnerabilities

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in NVIDIA DGX Spark UEFI. The vulnerability allows a privileged local user to bypass administrator password protection. The affected version is prior to 1.110.13.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.