Nine point eight. That is the number that travelled. CVE-2026-65113 — a hardcoded credential sitting inside NVIDIA's Infrastructure Controller, NICo — scored CVSS 9.8 on the published vector, and the security timeline lit up the way it always does: screenshots, red arrows, the phrase "entire datacenter security model compromised" recycled from a hundred prior cycles.
Then somebody checked EPSS. Zero point six one one percent. Forty-eighth percentile. A vulnerability rated maximally severe and a real-world exploitation probability rated below the median, pointing in opposite directions like two instruments in the same cockpit disagreeing at altitude.
That divergence is not noise. It is the story, and almost nobody is reading it. The interesting character in this disclosure is not the 9.8. It is the S:U.
Context
NICo — the NVIDIA Infrastructure Controller — is not a peripheral utility. By its own documentation it "secures datacenter infrastructure at its foundation." Functionally, it is the authority layer for rack-scale AI: bare-metal lifecycle orchestration, hardware discovery, firmware attestation, BlueField DPU configuration, network isolation between tenants, tenant sanitization between workloads. It governs GB200 and GB300 racks — the physical substrate on which the entire current capex narrative is priced.
And it shipped with a hardcoded credential. CWE-798. The single most preventable class of defect in MITRE's Top 25, the category that static analysis tooling is purpose-built to catch at commit time, before a line of code reaches a build pipeline. That it survived to production in a security product is the finding. Everything else is commentary.
The rest of the batch confirms the diagnosis rather than complicating it. Fourteen CVEs in one disclosure window: SQL injection, missing authentication, improper certificate validation in two places, XML injection, inadequate workflow enforcement. One critical, five high, eight medium. That is not a cluster of unrelated accidents. That is the signature of a missing secure development lifecycle — no unified input validation framework, no consistent auth model, no certificate trust policy, no gate that stops a literal password from being committed. A single bug is fate. Fourteen of them are process.
I have watched this exact pattern three times, in a different industry. In 2017 I audited the whitepapers of twelve top-20 token launches and flagged three structural contradictions in their economic models that later proved fatal — Bancor's automated market maker among them, in a piece called "The Liquidity Illusion." In 2020 I spent three months mapping flash-loan cascades across Aave, Compound and Uniswap, protocols that each looked sound in isolation and were not sound in composition. In 2022 I modelled stablecoin de-pegs against liquidity depth and published two weeks before FTX.
Different sectors. Identical tell. When a system markets the word "trust" and the engineering underneath fails at the most elementary layer, you are not looking at a bug. You are looking at a maturity gap between the narrative and the code. The whitepaper and the technical reality were never on speaking terms. That was true of tokenomics in 2017. It is true of a zero-trust control plane with a hardcoded password.
Core
The most consequential line in the disclosure is buried: hardware-level security integrity enforced by the BlueField DPU depends on the security of the controller. Read that again, because it inverts the architecture. In a correct design, the hardware root of trust protects the software above it. Here, a software control plane is the precondition for the hardware isolation guarantee. The DPU deliberately does not answer to tenant host operating systems — that was the entire selling point of the silicon-level isolation model. It answers to NICo. Which means the tenant isolation guarantee is not enforced by silicon at all. It is enforced by a service that accepts a static string.
That is the inversion. Hardware trust rooted in software convenience.
The second structural fact: convergence. Every tenant's isolation, data integrity, and availability resolve to the same orchestration authority. One authentication failure at that layer moves laterally across racks — not through a vulnerability chain, not through a clever exploit, but through the front door, because the door was left unlocked by design. When I analysed composability risk in 2020 I was looking for single points of failure that only manifested when protocols were stacked. This is simpler and worse: the single point of failure was shipped as a feature.
Now the numbers, because the numbers are where the market is being lied to.
CVSS 9.8 on vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, unauthenticated, no-user-interaction defect with high impact across confidentiality, integrity and availability. It describes the blast radius if an attacker is already positioned. EPSS 0.611% describes how difficult that positioning is. Both are correct. Neither is actionable on its own.
The word that reconciles them is S:U — Scope Unchanged. The impact does not cross a security boundary in CVSS's model, because management planes are conventionally deployed isolated from production networks, physically or logically. So the true risk variable is not patch latency. It is topology. Security has been sold as a patch problem for twenty years; this is a segmentation problem wearing a patch problem's clothes. No number on any scorecard will tell you whether your management plane is reachable from a compromised tenant VM. Your network diagram will.
Which brings us to the fix, and the fix is a trap. Upgrade to 2.0. Fine. Now execute that across a rack estate managing GB200 and GB300: firmware versions, DPU configuration state, tenant environment coupling, rollback capacity, maintenance windows negotiated with customers who are paying for uptime. The migration is not a package upgrade. It is a coordinated reconfiguration of the trust chain. Downtime is a given. Configuration drift is likely. The exposure window created by the remediation may exceed the exposure window it was designed to close. Nobody puts that in a press release, and it is the part infrastructure operators will actually live with.
Two further properties deserve attention. First, NICo is open source. The vulnerable code is readable by every attacker who cares to look, and the patched code is equally readable — meaning the exploit primitive is public, and the fix must propagate through community upgrade cadence rather than a controlled distribution. Slower tail. Longer exposure. Second, the same openness means derivative branches and customised deployments inherit the defect. One upstream flaw, many downstream exposures, in third-party AI clouds that never appeared in the original advisory. Supply chain risk in its most literal form.
And here is where my desk sits, because this is not only an NVIDIA problem.
The decentralised GPU compute narrative — DePIN rental markets, tokenised bare-metal provisioning, on-demand inference networks — is being priced on the assumption that rack orchestration is a solved problem inherited from the enterprise world. It is not solved. It is the exact architecture we are now watching fail at the basic layer, deployed by teams with thinner security engineering budgets and a token that pays them to onboard hardware faster. The incentive that rewards you for onboarding GPUs quickly is the same incentive that rewards you for skipping the static analysis gate. And the party that eats the loss from a cross-tenant data leak is not the party that captured the narrative premium. That asymmetry is not a bug in the token design. It is the token design.
In 2026 I spent six months dissecting the economic incentives of the first AI-agent-to-smart-contract interactions and published "The Trustless Agent Economy," which argued that autonomous agents had no adequate verification layer. The gap I identified there is the same gap here, one layer down. Autonomous systems do not need better promises about their runtime environment. They need signed, verifiable proof of it. Keys held in hardware security modules, not in source code. Controller state attested and checkable by the tenant, not asserted by the vendor. Confidential computing as a compensating control when the control plane cannot be fully trusted — a scenario that, post-NICo, must now be treated as the default assumption rather than the paranoid one.
There is a version of this story where 2.0 removes the hardcoded credential mechanism entirely. There is a more probable version, based on two decades of patch notes, where it rotates the value and leaves the architecture. The distinction matters more than the CVE.
The thesis held firm when the charts turned red. It holds here too, and the chart is a trust chain.
Contrarian
The consensus forming is comfortable and wrong in an instructive way: "the management plane is the new attack surface, buy cloud-native security." I would push back on three counts.
First, EPSS is the honest number and CVSS 9.8 is the quotable one, and the industry keeps choosing the quotable one because severity scores make better headlines than deployment topology surveys. The result is a market that systematically misallocates attention toward patches and away from architecture.
Second, EPSS may be wrong in the direction of danger, and for a reason its model cannot see. EPSS is trained on historical exploitation patterns. If the credential has been sitting in a public repository — and this is an open-source tool — then discovery cost approaches zero, which is precisely the condition under which statistical models of attacker behaviour underweight risk. The 0.611% may not be a floor. It may be an artefact.
Third, and most contrarian of all: none of this dethrones NVIDIA. CUDA, NVLink, allocation scarcity — those are the moat. A control plane CVE is a reputational marginal cost, not a capability substitution. What it does is hand competitors free intelligence about software maturity and give hyperscalers a renewed argument for self-developed control stacks. Watch the procurement language, not the share price. s chaos.
Takeaway
The next narrative is not "AI security" as a sector. Sector narratives are where original thinking goes to die. The next narrative is verifiability: who can prove, rather than claim, the state of their control plane. Watch for independently audited remediation, external key custody, and signed attestation as a competitive feature rather than a compliance afterthought.
One caveat, and it is not a formality. The disclosure references a 2026 timeline and an unattributed aggregation source; at time of writing I have not confirmed the CVE in an official vulnerability registry. Treat the architecture lesson as real and the event as unverified. That distinction is the job.
The question is not whether the next control plane fails. It is whether anyone will be able to tell you that it did.
