NVIDIA patches critical hard-coded credentials flaw in NICo data center controller

NVIDIA disclosed CVE-2026-65113, a hard-coded credentials flaw (CWE-798) in its Infrastructure Controller (NICo) for Linux, rated 9.8 on CVSS v3.1 and present in every version from 0 through 1.9. The bug lets an unauthenticated remote attacker bypass authentication; the fix is NICo 2.0. The advisory bundles 14 CVEs, including five high-severity issues.

• CVE-2026-65113 rated 9.8; NICo versions 0 through 1.9 affected
• Fix is NICo 2.0 from the official repository
• Advisory covers 14 CVEs: one critical, five high, eight medium
• SQL injection CVE-2026-65128 at 8.8 can lead to code execution