CVE-2026-24185: NVIDIA NVOS Privilege Escalation Flaw

CVE-2026-24185 Overview

CVE-2026-24185 affects NVIDIA NVOS, the network operating system used on NVIDIA network switches. The vulnerability resides in the secure shell (SSH) server configuration component when public key authentication (PKA)-only mode is enabled. An administrator can inadvertently enable an alternative authentication path that bypasses the intended PKA-only restriction. When default passwords are not rotated according to NVIDIA guidance, this alternative path can allow unauthorized SSH access. Successful exploitation may lead to privilege escalation on the switch. The flaw is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
An adjacent-network attacker with low privileges can bypass PKA-only SSH authentication and escalate privileges on NVIDIA network switches running NVOS.

Affected Products

NVIDIA NVOS running on NVIDIA network switches
Deployments with SSH PKA-only mode enabled
Switches retaining default administrative passwords

Discovery Timeline

2026-08-18 - CVE-2026-24185 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-24185

Vulnerability Analysis

CVE-2026-24185 is an authentication bypass affecting the SSH server configuration of NVIDIA NVOS. Administrators can configure the switch to require public key authentication only, expecting password-based logins to be disabled. However, the SSH server exposes an alternative authentication path that remains reachable when specific administrative settings are applied. This alternative path can accept credentials outside the PKA-only enforcement.

When combined with unchanged default passwords, the alternative path allows an attacker on the adjacent network to authenticate to the switch management interface. Because NVOS administrative accounts hold elevated permissions, gaining shell access effectively grants control over switch configuration and traffic policies.

Exploitation requires network adjacency and some knowledge of the target configuration, which raises attack complexity. The vulnerability affects confidentiality, integrity, and availability of the switch. It is categorized under [CWE-288] as an authentication bypass using an alternate channel.

Root Cause

The root cause is inconsistent enforcement of PKA-only mode within the NVOS SSH server. The configuration parameter that enables PKA-only authentication does not fully suppress alternative authentication mechanisms. As a result, an administrator applying default hardening steps can leave a secondary credential path active without indication.

Attack Vector

The attack requires access to the management network segment where the NVOS SSH service listens. An attacker submits authentication requests against the alternative path exposed by the misapplied configuration. If default credentials remain on the device, the attacker authenticates and obtains an administrative session. See the NVIDIA product security advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-24185

Indicators of Compromise

SSH authentication events on NVOS switches using password authentication while PKA-only mode is expected to be enforced
Successful administrative logins from unexpected source addresses on the switch management VLAN
Configuration changes on switches immediately following an SSH login that did not use a known public key
New administrative accounts, altered ACLs, or unexpected changes to routing or port configuration

Detection Strategies

Audit NVOS SSH server configuration to confirm PKA-only mode is applied and no alternative authentication path is enabled
Correlate SSH login events with the authentication method used, flagging any password-based success on PKA-only devices
Enumerate switches still using default credentials against the current NVIDIA hardening guidance

Monitoring Recommendations

Forward NVOS syslog and AAA authentication logs to a central SIEM for continuous review
Alert on any SSH authentication success where the method is not publickey on PKA-only switches
Monitor privileged CLI commands executed shortly after SSH session establishment

How to Mitigate CVE-2026-24185

Immediate Actions Required

Replace default administrative passwords on all NVOS switches as recommended by NVIDIA
Review SSH server configuration on each switch and confirm PKA-only mode is enforced without an alternative authentication path
Restrict management-plane access to trusted administrative networks and jump hosts using ACLs
Apply vendor guidance and updates referenced in the NVIDIA product security advisory

Patch Information

Refer to the NVIDIA product security advisory for CVE-2026-24185 for the current list of fixed NVOS versions and remediation steps. Additional references are available at the NVD entry and the CVE.org record.

Workarounds

Rotate all default and shared credentials on NVOS devices before enabling PKA-only mode
Limit SSH exposure to a dedicated out-of-band management network
Disable unused authentication methods and verify that only publickey is accepted on PKA-only switches
Enforce multi-factor administrative access through a bastion host where feasible

bash

# Configuration example
# Review effective SSH configuration on an NVOS switch
show ssh server

# Confirm PKA-only enforcement and remove alternative authentication paths
# (Apply per NVIDIA advisory guidance for your NVOS release)