What is the CVSS score of EUVD-2026-61105?

EUVD-2026-61105 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of NVIDIA NVOS are affected by EUVD-2026-61105?

NVIDIA NVOS network switches are vulnerable to privilege escalation (CVE-2026-24185, CVSS 7.1) that enables adjacent-network attackers to bypass PKA-only SSH enforcement and gain switch management…

How to fix or mitigate EUVD-2026-61105?

Within 24 hours, rotate all default administrative credentials on affected NVIDIA NVOS network switches per vendor hardening guidance and restrict SSH management access to trusted administrative networks using firewall rules. Within 7 days, complete an inventory of all NVIDIA NVOS devices in production, verify PKA-only SSH mode is properly enforced without alternative authentication channels, and implement network segmentation to isolate management access to dedicated administrative VLANs. Within 30 days, establish monitoring of NVIDIA security advisories for patch availability and prepare for immediate deployment of vendor patches when released; implement authentication logging and alerting on NVOS devices to detect exploitation attempts.

NVIDIA NVOS EUVD-2026-61105

| CVE-2026-24185 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-18 nvidia

GHSA-6mg4-xcv2-5mx2

Authentication Bypass Nvos Nvidia

7.1

CVSS 3.1 · Vendor: nvidia

Severity by source

Vendor (nvidia) PRIMARY

7.1 HIGH

AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AV:A for management-plane adjacency requirement; AC:H for dual conditions (PKA-only mode plus default password); PR:N because exploitation leverages default credentials on the alternative path without requiring a pre-existing system account.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (nvidia).

CVSS VectorVendor: nvidia

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 18:53 vuln.today

CVE Published

Aug 18, 2026 - 18:16 cve.org

HIGH 7.1

DescriptionCVE.org

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.

Articles & Coverage 1

News 6 New Nvidia Vulnerabilities - 1 Critical, 5 High Severity Aug 19, 2026

AnalysisAI

Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.

Technical ContextAI

NVIDIA NVOS is the proprietary operating system running on NVIDIA-branded data center and campus network switches. The vulnerability resides in the SSH server configuration subsystem, specifically the logic that governs authentication modes. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) defines the root cause class: the system's primary control - PKA-only mode, which is intended to enforce public key authentication exclusively - fails to fully suppress a secondary authentication mechanism, likely password-based SSH login. The result is that enabling the more restrictive mode creates a configuration state that paradoxically re-exposes the weaker path. The affected CPE cpe:2.3:a:nvidia:nvos:*:*:*:*:*:*:*:* uses a full wildcard on the version field, indicating either all released NVOS versions are affected or that NVIDIA has not yet bounded the vulnerable range in NVD.

RemediationAI

Consult the NVIDIA Product Security advisory at https://github.com/NVIDIA/product-security/tree/main/2026/5817 for any available patched NVOS release - no specific fixed version number was confirmed from the provided references. As an immediate compensating control, replace the default device password on all NVOS switches per NVIDIA's documented hardening guidance; this directly eliminates the exploitable condition because the alternative authentication path is only dangerous when default credentials remain active. If PKA-only mode is not operationally required, disabling it prevents the inadvertent activation of the alternate authentication path entirely, with the trade-off that public key enforcement is no longer enforced by the OS. Restrict SSH access to the switch management interface to a dedicated out-of-band management network or a narrowly scoped allowlist of trusted IP ranges, reducing the adjacent-network reachability required by AV:A. Network-level controls such as 802.1X on management ports can further limit who can reach the management plane.