Critical vulnerabilities in NVIDIA Triton Inference Server enable takeover and code execution
Security researchers discovered a chain of three critical vulnerabilities in NVIDIA's Triton Inference Server that could allow attackers to take over AI servers, execute arbitrary code, and steal data. NVIDIA released a patch on August 4, 2025, and researchers stated no active exploitation had been observed at the time of disclosure.
What happened
Security researchers at Wiz discovered a chain of three vulnerabilities in NVIDIA's Triton Inference Server (CVE-2025-23319, CVE-2025-23320, and CVE-2025-23334) that, when combined, could allow an attacker with no prior access to take full control of an AI server.
According to Wiz head of vulnerability research Nir Ohfeld, the attack begins with a minor bug that causes the server to leak secret internal data, which an attacker can then use to manipulate the server's legitimate features to gain control over a private system component and escalate privileges.
Reported impact
The vulnerabilities could enable remote code execution, data theft, model takeover, and response manipulation if not patched.
Triton is used by enterprises including Microsoft, Amazon, Oracle, Siemens, and American Express, though the full scope of affected customers is unknown.
Index analysis
As of the disclosure, Wiz stated it had not seen evidence of these vulnerabilities being exploited in the wild, though it noted that Triton is a widely used platform for AI workloads.
NVIDIA released a patched version (25.07 or newer) on August 4, 2025, with Wiz recommending that all users update immediately to directly fix the entire vulnerability chain.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.