CVE-2026-20325

Cisco Nexus Dashboard contains a command injection vulnerability (CWE-77) in which special elements in user-controlled input are improperly neutralized before being passed to an operating system command. An attacker needs network access to the management interface and a valid low-privileged account, with no user interaction required; the changed scope in the CVSS vector indicates successful commands can impact components beyond the vulnerable one. A successful attacker gains the ability to run arbitrary commands in the context of the affected service, with high impact on confidentiality, integrity, and availability, potentially compromising the Nexus Dashboard appliance and the fabric management functions it hosts. Any organization running Cisco Nexus Dashboard to manage its data center switching estate is in scope. The flaw was found by Cisco's internal review as part of a software hardening release; there is no public proof-of-concept, it is not in CISA KEV, and no exploitation is currently known.

What to do: Upgrade Nexus Dashboard to the software hardening release identified in Cisco's advisory (check the Cisco PSIRT bulletin for the exact fixed versions), as the flaw was fixed proactively. Until patched, restrict access to the Nexus Dashboard management interface to trusted admin networks and audit low-privileged user accounts that could reach the affected functionality. Monitor Cisco PSIRT and CISA KEV for updates, since low-privilege authenticated command injection with these CVSS metrics is likely to draw exploit research once details surface.