CVE-2026-24185CWE-288

CVE-2026-24185

High · published August 18, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-08-18T23:16Z
References (3)
https://github.com/NVIDIA/product-security/tree/main/2026/5817 · [email protected]https://nvd.nist.gov/vuln/detail/CVE-2026-24185 · [email protected]https://www.cve.org/CVERecord?id=CVE-2026-24185 · [email protected]
EPSS history
Timeline
  • 18 AUG 18:16Z
    NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an…
    cvelistv5