CVE-2026-20322

CVE-2026-20322 covers multiple improper access control vulnerabilities (CWE-284) in Cisco Nexus Dashboard that were found by Cisco's own engineering team during an internal security review and fixed in a software hardening release. Per the CVSS vector, exploitation requires network access and valid low-privileged credentials (AV:N/PR:L), with no user interaction, and because the scope is changed (S:C), a successful attacker can cross a security boundary to gain high-privileged access to data and functions (confidentiality, integrity, and availability all rated high). In practical terms, an attacker with any low-level authenticated account — such as a guest or limited operator account — could bypass intended access restrictions on the management platform that centralizes control of Cisco data center fabrics. All organizations running affected Cisco Nexus Dashboard deployments are in scope. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and no exploitation has been reported; specific affected and fixed version ranges are not included in the available data and must be taken from the Cisco advisory.

What to do: Check the Cisco PSIRT advisory for CVE-2026-20322 to identify whether your Nexus Dashboard release is affected and upgrade to the software hardening release it specifies. Because exploitation requires low-privileged credentials, audit the platform for unnecessary or shared low-privilege user accounts and API keys, remove them, and restrict access to the Nexus Dashboard management interface to trusted admin networks. No public PoC or in-the-wild exploitation is known, so treat this as a high-priority routine patch rather than an emergency.