CVE WatchAug 20, 2026

CVE-2026-24185

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is en

CVSS

7.1

High

EPSS

0.2%

p11

KEV

—

Exploit Today

0-100

Published: Aug 18, 2026 · Last modified: Aug 20, 2026 · CWE-288

EPSS · 30d

Not enough EPSS history yet.

Technical description

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access. A successful exploit of this vulnerability might lead to escalation of privileges.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-740019.8 CRI

—

———Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.6h CVE-2026-666777.6 HIG

—

———Subscriber Broken Authentication in Leyka <= 3.32.3 versions.7h CVE-2026-19490—

—

——0Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.9h CVE-2026-501918.8 HIG

25.7%

——84gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/access-tokens permits that account to authenticate while isVerified is false. During the victim's first SSO login, server/api/helpers/users/get-create-one-for-github-sso.js, server/api/helpers/users/get-create-one-for-google-sso.js, server/api/helpers/users/get-create-one-for-microsoft-sso.js, and server/api/helpers/users/get-create-one-for-oidc-sso.js find the attacker-controlled account by email and link the verified SSO identity without confirming ownership of the local account. The attacker can retain local-password access to the linked account and obtain the victim's projects, data, and permissions. This issue is fixed in version 3.3.8.1d CVE-2021-437185.3 MED

15.8%

——5An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Denial of Service via specially crafted series of HTTP..9h CVE-2026-71879—

39.4%

——12Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass2d