CVE-2026-20212
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRelated articles
VulnerabilitiesCisco Discloses New Vulnerabilities in Secure Email, IOS XR, Nexus 9000 Switches, and IP Phones
Cisco disclosed Sept 2026 flaws in Secure Email, IOS XR, Nexus 9000 and IP Phones, including S/MIME decryption issues, RCE and root compromise risks.
VulnerabilitiesCisco Nexus 9000: Critical Flaw Enables Remote Root Code Execution
Cisco fixed CVE-2026-20212 (CVSS 9.8) in 10 Nexus 9000 models allowing unauthenticated remote root code execution via TCP ports 43210, 43211.
This product uses the NVD API but is not endorsed or certified by the NVD.