60
35
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.
Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.
88
55
42
60
30
30
60
55
55
60
55
60
30
42
30
55
55
60
55
30
60
Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
60
60
60
55
60
60
55
60
Cisco Releases Security Updates for Actively Exploited SD
60
35
47
60
30
30
30
Fwd: [mapserver-announce] security release available: MapServer 8.6.6
The MapServer team released 8.6.6 as an immediate security release fixing six vulnerabilities; administrators running older versions should upgrade.
The MapServer project announced the immediate availability of MapServer 8.6.6, a security release containing fixes for six vulnerabilities. The announcement via the mapserver-announce list did not include CVE identifiers or per-flaw details. MapServer is an open-source web mapping platform, and administrators of deployments on 8.6.5 or earlier are advised to upgrade.
38
60