🔘 Vulnerability(cybersecuritynews.com): Cisco Nexus 9000 Series Switches Flaw Allows Remote Attackers to Execute Malicious Code
✉ 03.09.2026 10:08:41 Abinaya
💻 Cisco has disclosed a critical vulnerability in Cisco Nexus 9000 Series Switches that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Tracked as CVE-2026-20212, the flaw has received a CVSS score of 9.8 out of 10 and affects Nexus 9000 models that use a Silicon One ASIC. The security issue, identified as CWE-1327, is detailed in Cisco advisory cisco-sa-n9k-s1-rce-EH8dEtr, published on September 2, 2026.
Cisco said the vulnerability was discovered while resolving a Technical Assistance Center support case. At the time of publication, Cisco PSIRT said it was not aware of public exploitation or malicious activity involving the flaw.
The vulnerability exists because TCP ports 43210 and 43211 are reachable through the default Layer 3 virtual routing and forwarding configuration on affected devices. An attacker does not need valid credentials to target the vulnerable service.
By connecting to an exposed switch and sending specially crafted input, an attacker could cause that input to be executed as code with root-level privileges.
Cisco Nexus 9000 Series Switches Vulnerability
Root access would give an attacker broad control over the targeted switch. This could enable changes to network configuration, traffic monitoring, service disruption, data interception, or movement to other systems connected to the network.
Successful exploitation can also crash the S1HAL process, Cisco warned, potentially forcing the affected device to reload and causing a network outage. The issue affects Cisco Nexus 9000 Series Switches that include a Silicon One ASIC.
Cisco listed several affected product identifiers, including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808.
Administrators can identify the installed module and product identifier by running the show module command on the switch. Organizations should compare the returned model number against Cisco’s affected-product list and then verify whether their current NX-OS release is vulnerable through the Cisco Software Checker.
Cisco confirmed that other Nexus 9000 models not listed in the advisory are not affected. Nexus 9000 Fabric Switches operating in ACI mode are also not vulnerable.
Other confirmed unaffected products include Nexus 3000 and Nexus 7000 Series Switches, MDS 9000 Series Multilayer Switches, Cisco Firepower appliances, Secure Firewall products, and several UCS Fabric Interconnect platforms.
Cisco has released software updates to address CVE-2026-20212 a...
#Cisco #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
https://cybersecuritynews.com/cisco-nexus-9000-series-switches-vulnerability/
read it on CSN:
https://csn.net4me.net/cyber_security_27912.html
Cyber Security News
Cisco Nexus 9000 Series Switches Flaw Allows Remote Attackers to Execute Malicious Code
Cisco disclosed a critical Nexus 9000 flaw enabling unauthenticated remote code execution with root privileges.
September 3, 2026 5
