CVE-2026-24185 Auth bypass in NVOS
Administrators using PKA-only mode with default passwords may face unauthorized access and privilege escalation due to an alternative authentication path.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-24185?
CVE-2026-24185 is a high-severity authentication bypass vulnerability in NVIDIA NVOS, published on 18 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.
Weakness: CWE-288
Which versions are affected by CVE-2026-24185?
How do I fix CVE-2026-24185?
No fix has been published for CVE-2026-24185 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-24185 being exploited?
There is no known exploitation of CVE-2026-24185 in the wild and no public exploit code.
Sources
Also known as GHSA-6mg4-xcv2-5mx2.