CVE-2026-44484 affects PyTorch Lightning versions 2.6.2 and 2.6.3 by introducing functionality consistent with embedded malicious code designed to harvest credentials. This vulnerability is categorized under CWE-506 (Embedded Malicious Code) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability. The vendor advisory from Red Hat does not provide explicit remediation or patch information, and no known exploits are reported in the wild.

The vulnerability allows an attacker to potentially harvest credentials through malicious code embedded in the affected PyTorch Lightning versions. Given the high CVSS score and critical severity, exploitation could lead to significant compromise of confidentiality, integrity, and availability of systems using these versions. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should avoid using versions 2.6.2 and 2.6.3 of PyTorch Lightning until further notice. Monitor official vendor channels, including the Red Hat advisory, for updates on remediation or patches.