What is the CVSS score of EUVD-2026-61103?

EUVD-2026-61103 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cumulus Linux are affected by EUVD-2026-61103?

NVIDIA Cumulus Linux network switch operating systems are vulnerable to local privilege escalation (CVE-2026-24183, CVSS 7.8) with no public exploit identified at time of analysis.

How to fix or mitigate EUVD-2026-61103?

Within 24 hours: Inventory all NVIDIA Cumulus Linux deployments and document current versions to determine exposure scope. Within 7 days: Restrict local console and SSH access to network switches using role-based access controls, disable unnecessary local user accounts, and implement monitoring for privilege escalation attempts. Within 30 days: Maintain vigilance for vendor security advisories and evaluate firmware/OS upgrade paths; contact NVIDIA support for patch timelines and consider interim replacements or network segmentation if effective access controls cannot be implemented.

Cumulus Linux EUVD-2026-61103

| CVE-2026-24183 HIGH

Execution with Unnecessary Privileges (CWE-250)

2026-08-18 nvidia

GHSA-xqjq-frh8-2qr2

Privilege Escalation Nvidia Cumulus Linux Ga

7.8

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local attack vector confirmed by description; low-privilege local account sufficient per CWE-250 pattern; full triad impact reflects root-equivalent escalation on the switch.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 18:54 vuln.today

CVE Published

Aug 18, 2026 - 18:16 cve.org

HIGH 7.8

DescriptionCVE.org

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges.

Articles & Coverage 1

News 6 New Nvidia Vulnerabilities - 1 Critical, 5 High Severity Aug 19, 2026

AnalysisAI

Local privilege escalation in NVIDIA Cumulus Linux exposes network switch operating systems to full compromise by unprivileged local users. The flaw resides in the user management component, where improper privilege assignment (CWE-250) allows a low-privileged authenticated user to escalate to higher privilege levels - likely root - with low attack complexity and no user interaction required. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the CVSS 7.8 High score reflects the full triad impact once local access is obtained.

Technical ContextAI

Cumulus Linux is a Debian-based network operating system developed by NVIDIA (formerly Mellanox/Cumulus Networks) designed to run on bare-metal network switches from vendors such as Dell, Mellenox, and others. As a Linux derivative, its user management subsystem handles privilege separation between standard and privileged accounts. CWE-250 (Execution with Unnecessary Privileges) indicates that one or more processes, binaries, or management utilities within the user management component execute with privileges exceeding those required for their function - a common root cause for SUID/SGID binary abuse, misconfigured sudo policies, or services running as root unnecessarily. The affected CPE cpe:2.3:a:nvidia:cumulus_linux_ga:*:*:*:*:*:*:*:* covers all General Availability releases of the product, with no version range exclusions indicated in available data.

RemediationAI

Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5817 for the specific patched Cumulus Linux release and upgrade instructions. An exact fix version is not independently confirmable from the available data; operators should monitor NVIDIA's security bulletin for the official patched build. As a compensating control pending patching, restrict SSH and console access to Cumulus Linux management interfaces to only authorized network engineering personnel - reducing the pool of accounts that could exploit this flaw. Audit all local user accounts on switches for necessity, removing or disabling any stale or overly-permissive accounts. Review sudo policies and SUID binaries on Cumulus Linux hosts (find / -perm -4000 and sudo -l review) to identify and restrict unnecessary elevated-privilege execution pathways. Enabling centralized logging of privilege escalation events (via syslog or Syslog-NG forwarding to a SIEM) provides detection capability while a patch is pending.