CVE-2026-20360

Cisco Nexus Dashboard contains multiple internally discovered information-exposure and insecure-handling flaws (CWE-200), which Cisco is addressing together in a software hardening release. Based on the CVSS vector, the issues can be triggered remotely by an authenticated low-privileged user, with no user interaction or special conditions required. An attacker who successfully exploits these flaws can obtain sensitive information, and the 8.8 (high) rating indicates potential high impact to confidentiality, integrity, and availability. Any organization running Cisco Nexus Dashboard as the management/control platform for its Cisco data-center environment is potentially affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Review the Cisco PSIRT advisory for the exact fixed Nexus Dashboard release and upgrade promptly, since this hardening release bundles multiple internally found flaws. Restrict Nexus Dashboard management access to trusted administrative networks, review low-privileged user accounts and exposed services for signs of information gathering, and monitor Cisco for updated guidance as more detail on the individual issues may emerge.