CVE-2026-20361

Cisco Nexus Dashboard contains SQL injection flaws (CWE-89) that were found during an internal Cisco security review and are addressed in a software hardening release. A remote attacker who already holds low-privilege credentials can send crafted input to a vulnerable interface, causing arbitrary SQL queries against the backend database. Successful exploitation could expose or tamper with sensitive data and potentially disrupt the service, consistent with the high CVSS 3.1 score of 8.8. Any organization running an affected Cisco Nexus Dashboard release is exposed; specific affected and fixed version ranges are provided in Cisco's PSIRT advisory. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and no exploitation has been reported.

What to do: Upgrade Nexus Dashboard to the hardened release identified in Cisco's PSIRT advisory for CVE-2026-20361 (exact fixed version numbers are not included in the available data). Because exploitation requires low-privilege authenticated access, restrict management interfaces to trusted admin networks, review accounts with low-privilege roles, and check logs for unexpected database-oriented requests. Monitor the Cisco advisory for updated fixed-version and mitigation guidance.