A critical Cisco Nexus 9000 vulnerability can allow remote attackers to execute code as root on affected switches without credentials or user interaction.
Cisco disclosed CVE-2026-20212 on September 2 with a CVSS score of 9.8. The flaw affects certain Nexus 9000 switches containing Silicon One ASICs and can lead to both remote code execution and device outages.
Cisco’s security advisory for CVE-2026-20212 says TCP ports 43210 and 43211 are accessible through the default Layer 3 virtual routing and forwarding instance. An unauthenticated attacker who can reach either port could send crafted input that executes as code with root privileges.
Actual exposure depends heavily on network topology. An affected switch does not need to be internet-facing to be at risk if ports 43210 or 43211 are reachable from a compromised or less-trusted internal network segment.
How CVE-2026-20212 works
CVE-2026-20212 is classified as CWE-1327, or binding to an unrestricted IP address. The flaw is network-accessible and low complexity, with no privileges or user interaction required. Cisco rates its potential confidentiality, integrity, and availability impacts as High.
Exploitation can also crash the S1HAL process and cause the affected switch to reload, creating a denial-of-service risk alongside root-level code execution.
Cisco’s September 2 advisory listed 10 affected Nexus 9000 product identifiers containing Silicon One ASICs. Administrators can run show module to identify a device’s product ID and compare it with Cisco’s list. Nexus 3000 and 7000 switches, other Nexus 9000 models, and Nexus 9000 Fabric Switches in ACI mode are not affected.
Recent attacks have also put Cisco network infrastructure in the crosshairs. A September investigation detailed how attackers turned compromised Cisco routers into covert network gateways, while an August Cisco update addressed a firewall flaw already exploited in attacks.
As of September 3, Cisco’s advisory says its Product Security Incident Response Team is not aware of malicious use or public announcements involving CVE-2026-20212.
Patching and mitigation priorities
Cisco has released fixed NX-OS software and recommends upgrading for full remediation. For organizations that cannot patch immediately, Cisco tested an infrastructure access control list workaround that allows only required management and control-plane traffic to affected devices. Administrators can alternatively use iACLs to deny TCP traffic to locally configured device addresses on ports 43210 and 43211.
Cisco also released a Live Protect shield as a temporary mitigation until software updates can be scheduled. The shield does not replace patching; Cisco directs customers to a fixed software release for full remediation.
Organizations should take these steps:
- Upgrade affected NX-OS systems: Move vulnerable Nexus 9000 switches to a fixed software release.
- Verify affected hardware: Run
show moduleand compare product IDs with Cisco’s affected-model list. - Restrict vulnerable ports: Apply Cisco’s iACL workaround to limit required traffic or block ports 43210 and 43211 where appropriate.
- Use temporary protection when needed: Deploy Live Protect only as a bridge until fixed software can be installed.
- Monitor switching infrastructure: Investigate unexplained reloads, abnormal management traffic, and unexpected connections to the affected ports.
- Prioritize low-barrier attack paths: Recent unauthenticated RCE exploitation shows how quickly attackers can capitalize on flaws that require neither credentials nor user interaction.
- Test incident response plans: Confirm teams can isolate affected switches, preserve logs, investigate suspicious traffic, restore service, and recover known-good configurations.
Cisco has not reported exploitation, but remote reachability, low attack complexity, and root-level execution warrant prompt remediation. Organizations with affected hardware should prioritize fixed NX-OS releases and determine whether ports 43210 and 43211 were reachable from less-trusted network segments.
Read more: Recent PaperCut pre-authentication RCE attacks also show why systems exposed before remediation may warrant compromise assessment even after patches are installed.