High severity · published Aug 18, 2026
CVE-2026-24185
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could…
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NV
NVOS · NVIDIA
0.0 to 25.0.2.4438; 0.0 to 25.0.2.6077 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24185
github.com
https://github.com/NVIDIA/product-security/tree/main/2026/5817
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-24185
www.cve.org
https://www.cve.org/CVERecord?id=CVE-2026-24185
More from NVOS
8.8
CVE-2025-33181
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command
8.8
CVE-2025-33180
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command
8.8
CVE-2025-33179
NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command