Cisco Nexus 9000: Critical Flaw Enables Remote Root Code Execution

Cisco has fixed CVE-2026-20212, a critical vulnerability in the Silicon One integration used by ten Nexus 9000 Series switch models. A remote, unauthenticated attacker can send specially crafted data to the device and execute code with root privileges.

The flaw has a CVSS score of 9.8 out of 10. In addition to compromising the switch, exploitation can crash the S1HAL process and trigger a device reload, potentially causing network outages.

Cisco PSIRT published the advisory on September 2, 2026, at 16:00 GMT, marking it as final version 1.0. The issue was reported on September 3, 2026.

Two TCP ports expose the component through the default VRF

CVE-2026-20212 depends on the accessibility of TCP ports 43210 and 43211 through the default Layer 3 Virtual Routing and Forwarding, or L3 VRF, on vulnerable switches.

An attacker who can reach any IP address configured on the device can open a connection to these ports and transmit malicious input. The system processes the data in a way that allows it to be executed as code with root privileges.

No credentials, prior privileges, or administrator interaction are required. The attack complexity is also considered low. These characteristics explain the near-maximum CVSS score:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vector indicates a network-based exploit that requires neither authentication nor user interaction. The potential impact on confidentiality, integrity, and availability is high, while the security scope remains unchanged.

The Cisco advisory appends the extended parameters E:X/RL:X/RC:X to the vector, while the base score matches the assessment listed in the NVD record. Additional technical references include Cisco Bug ID CSCwu32817 and CWE-1327.

Code execution is not the only possible outcome. Packets crafted to exploit the vulnerability can crash S1HAL, the process associated with the Silicon One hardware abstraction layer. The failure can cause the switch to reload, making the attack a potential denial-of-service event as well.

Cisco discovered the issue while its Technical Assistance Center was handling a support case. PSIRT states that it is not aware of malicious exploitation or additional public disclosures related to the vulnerability.

The ten vulnerable Nexus 9000 models

The flaw does not affect the entire Nexus 9000 family indiscriminately. Only ten Product IDs equipped with Silicon One ASICs are affected:

• N9324C-SE1U
• N9348Y2C6D-SE1U
• N9364E-SG2-O
• N9364E-SG2-Q
• N9396T12C-SE1
• N9348Y12C-SE1
• N9396Y12C-SE1
• N9336C-SE1
• N9K-C9804
• N9K-C9808

Administrators can identify the installed module by running the following command from the CLI:

show module

The returned information includes a Model field, which must be compared with the list of vulnerable PIDs. Cisco provides the following example of a device that identifies its module as N9336C-SE1:

switch# show module
Mod Ports Module-Type                                  Model        Status
--- ----- -------------------------------------------- ------------ --------
1   36    36x40/100G QSFP28 Ethernet Module            N9336C-SE1   ok

An inventory based only on the general name “Nexus 9000” is therefore insufficient. The exact PID of every device must be verified, including chassis and modules deployed in more complex infrastructures.

Cisco platforms not affected

Cisco has excluded all Nexus 9000 models other than the ten listed above. Nexus 9000 Series Fabric Switches operating in ACI mode are also not vulnerable.

The list of confirmed unaffected product families also includes:

• Nexus 3000 Series and Nexus 7000 Series;
• MDS 9000 Series Multilayer Switches;
• Firepower 1000, 2100, 4100, and 9300;
• Secure Firewall 200, 1200, 3100, 4200, and 6100;
• UCS 6300, 6400, 6500, and 6600 Series Fabric Interconnects;
• UCS X-Series Direct Fabric Interconnect 9108 100G.

The operating mode matters. A Nexus 9000 used as a Fabric Switch in ACI is explicitly among the excluded products, while a device with one of the vulnerable PIDs must be assessed and upgraded.

The patch is available, but the release must be verified

Cisco has released software updates to address CVE-2026-20212. However, no single release or build number applicable to all affected models has been disclosed.

Administrators should use the Cisco Software Checker, select the platform, and enter the installed NX-OS version. The tool returns the First Fixed release, meaning the first release that resolves the selected vulnerability.

When multiple security issues are present on the device, Combined First Fixed may also be available. This identifies the first version that addresses all vulnerabilities included in the check.

Before upgrading, administrators should also review Cisco’s recommendations for preferred releases. The version to install should be selected based on the specific Nexus 9000 model, its configuration, and the network’s operational requirements.

Upgrading to a fixed release remains the definitive remediation. Workarounds, filters, and additional protections only provide temporary risk reduction.

iACLs and Live Protect to reduce exposure

When an immediate upgrade is not possible, Cisco recommends a workaround based on an infrastructure access control list, or iACL. The rules should allow only the management and control-plane traffic actually required to reach the switch.

Alternatively, iACLs can explicitly block TCP packets addressed to a local IP address on the device over the following ports:

TCP/43210
TCP/43211

This filter prevents unauthorized hosts from reaching services exposed through the default L3 VRF. It must be deployed with careful consideration of the management architecture, monitoring networks, and tools that legitimately communicate with the switch.

Cisco successfully tested the iACL workaround in its own environment. The vendor nevertheless warns that overly restrictive ACLs may interfere with functionality or performance, so the rules should be validated before being introduced into production.

A dedicated Live Protect shield for CVE-2026-20212 is also available in Cisco NX-OS. The protection can cover the time required to plan maintenance, but it does not replace installation of the correct release.

Priority checks for network administrators

Organizations should begin with their asset inventory by running show module on every Nexus 9000 and checking for the ten affected PIDs. For vulnerable devices, administrators should then identify the installed NX-OS release and verify it using the Software Checker.

Until the upgrade is completed, organizations should ensure that TCP ports 43210 and 43211 are not reachable from unnecessary networks. Connections to these ports should also be reviewed in available logs and telemetry, particularly when they originate from unexpected segments.

No specific indicators of compromise have been provided. However, an unusual S1HAL crash or unexplained reload should still be investigated, as both are possible effects of exploitation, even though neither alone proves that exploitation occurred.

The available NVD information contains no indication that the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. As a result, there is currently no KEV listing date or federal remediation deadline. Cisco has also not reported observed attacks.

The absence of known exploitation does not reduce the flaw’s technical impact: remote access, no authentication requirement, root-level privileges, and the potential to reload the switch call for rapid remediation on affected devices.