Cisco Fixed Critical RCE in Nexus 9000 Series Switches
Cisco patched CVE-2026-20212 (CVSS 9.8) in Silicon One-based Nexus 9000 switches, allowing unauthenticated remote root code execution via TCP ports 43210/43211.
Cisco patched CVE-2026-20212 (CVSS 9.8), a flaw in the Silicon One integration for Nexus 9000 Series switches that lets unauthenticated remote attackers execute code with root privileges. TCP ports 43210 and 43211 are exposed through the default Layer 3 VRF, and exploitation can also crash the S1HAL process, forcing device reloads. Cisco TAC discovered the flaw during a support case; PSIRT is not aware of public disclosure or malicious exploitation. Workarounds include infrastructure ACLs or blocking the exposed ports, alongside a Live Protect shield pending fixed NX-OS upgrades.
- Unauthenticated remote root code execution via exposed TCP ports 43210 and 43211
- Affects only Nexus 9000 switches with Silicon One ASIC; ACI mode and Nexus 3000/7000 unaffected
- Workarounds: iACLs or blocking traffic to ports 43210/43211
- Live Protect shield offers temporary protection; fixed NX-OS release recommended
- No known public disclosure or active exploitation at disclosure time
- CVEs
- CVE-2026-20212
- Vendors
- Cisco
- Products
- Cisco Nexus 9000Silicon OneNX-OS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20212 | Unauthenticated RCE in Cisco Nexus 9000 Switches with Silicon One Integration | 9.8 | <1% |
From the original article
2 min read at securityaffairs.com
Cisco patched a critical Nexus 9000 vulnerability, CVE-2026-20212, allowing unauthenticated remote root code execution. Cisco has released patches for a critical flaw, tracked as tracked as CVE-2026-20212 (CVSS score of 9. 8) in 10 Silicon One-based Nexus 9000 switches.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.