PyTorch Lightning versions 2.6.2 and 2.6.3 contain embedded malicious code consistent with credential harvesting behavior, classified under CWE-506 (Embedded Malicious Code). The vulnerability allows an unauthenticated remote attacker to harvest credentials with high impact on confidentiality, integrity, and availability. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and can be performed remotely over the network. No vendor-provided patch or temporary fix is currently documented, and this is not a cloud service vulnerability.

The vulnerability enables credential harvesting, which can lead to unauthorized access and compromise of sensitive information. The critical CVSS score reflects high impact on confidentiality, integrity, and availability. Exploitation could allow attackers to capture credentials without requiring user interaction or privileges, potentially leading to further system compromise or data breaches. No known exploits have been reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using affected versions 2.6.2 and 2.6.3 of PyTorch Lightning. Monitor official Lightning-AI communications for updates. No vendor advisory or temporary fix is currently available.