Vulnerability in NVIDIA Nvos

CVE-2026-24185

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (20.9th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 20.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-24185: held from 0.002 to 0.003.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

  • NVIDIA Nvos — versions 0.0 to 25.0.2.4438, 0.0 to 25.0.2.6077

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-24185?
CVE-2026-24185 is a high-severity vulnerability in NVIDIA Nvos, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 7.1/10. Published 2026-08-18.
How severe is CVE-2026-24185?
High severity. CVSS v3 base score is 7.1 out of 10.