CVE-2026-20212: Critical Cisco Nexus 9000 Flaw Enables Unauthenticated Root RCE

Cisco has released security updates for a critical vulnerability affecting selected Nexus 9000 Series switches that can allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Tracked as CVE-2026-20212 and rated 9.8 on the CVSS scale, the flaw affects Nexus 9000 models equipped with a Cisco Silicon One ASIC.

The vulnerability stems from an unintended network exposure in the Silicon One integration. TCP ports 43210 and 43211 are accessible through the default Layer 3 virtual routing and forwarding (VRF) instance, allowing an attacker who can reach either port to connect directly to the vulnerable service. Crafted input sent through the exposed service can then be executed with root privileges.

Successful exploitation can also crash the S1HAL process, potentially forcing the affected switch to reload and causing network disruption. Cisco said its Product Security Incident Response Team was not aware of malicious exploitation or public announcements targeting the flaw when the advisory was released on September 2, 2026.

The vulnerability is especially significant because Nexus 9000 switches commonly operate at the center of enterprise and data-center networks. Root-level compromise could give an attacker extensive control over network configuration and potentially create opportunities for traffic interception, service disruption, persistence, or movement toward connected infrastructure.

Contact Sales

CVE-2026-20212 analysis

The vulnerability is classified as CWE-1327: Binding to an Unrestricted IP Address. The underlying problem is not an authentication implementation error but the exposure of a privileged Silicon One service through interfaces where it should not be reachable.

Under the default Layer 3 VRF configuration, TCP ports 43210 and 43211 listen in a manner that allows remote systems to reach the service. An attacker does not need a valid Cisco account, administrator credentials, or an existing foothold on the switch. They only need network connectivity to one of the affected device’s locally configured addresses on either vulnerable port.

Once connected, an adversary can send specially crafted input to the exposed service. Cisco confirms that this input can be interpreted and executed as code with root privileges, effectively giving the attacker the highest level of operating-system control available on the device.

The most important details for CVE-2026-20212 are reflected in its CVSS vector: network-based exploitation, low attack complexity, no privileges required, and no user interaction. Successful exploitation can have high impact on confidentiality, integrity, and availability.

CVE-2026-20212 affects Nexus 9000 switches containing a Silicon One ASIC. Cisco lists the following product identifiers as vulnerable at the time of disclosure:

• N9324C-SE1U
• N9348Y2C6D-SE1U
• N9364E-SG2-O
• N9364E-SG2-Q
• N9396T12C-SE1
• N9348Y12C-SE1
• N9396Y12C-SE1
• N9336C-SE1
• N9K-C9804
• N9K-C9808

To determine the PID for a device, use the show module CLI command. In the following example, the PID of the device is N9336C-SE1, which is on the list of devices that are affected by this vulnerability.

Cisco’s CVE record lists 45 affected NX-OS releases, beginning with 10.3(1) and extending through releases including 10.6(3) and 10.6(3s). Because exposure depends on both the switch model and NX-OS version, organizations should verify each system through Cisco’s Software Checker rather than relying only on the broad version range.

Cisco has confirmed that Nexus 9000 models not listed in the advisory are not affected. Nexus 9000 Fabric Switches operating in Application Centric Infrastructure (ACI) mode are also not vulnerable.

Other confirmed unaffected products include:

• Nexus 3000 Series switches
• Nexus 7000 Series switches
• MDS 9000 Series multilayer switches
• Cisco Firepower appliances
• Secure Firewall products
• Multiple UCS Fabric Interconnect platforms

This distinction is important because the vulnerability is specifically tied to the Silicon One integration present in the affected Nexus 9000 hardware rather than to NX-OS universally.

The potential post-compromise impact is substantial. An attacker operating as root could theoretically modify switch configuration, interfere with network services, manipulate routing or forwarding behavior, monitor traffic available to the compromised device, or attempt to establish persistence. These are realistic consequences of root-level device compromise, although Cisco has not reported such activity occurring through this vulnerability.

Exploitation can also have an immediate availability impact without establishing long-term access. Cisco warns that attempts to exploit the flaw can cause the Silicon One Hardware Abstraction Layer process, S1HAL, to crash. A crash can cause the entire device to reload, potentially interrupting connectivity for systems depending on the affected switch.

Cisco discovered the vulnerability while resolving a Technical Assistance Center support case. The company has not disclosed the exact date on which the underlying security issue was first identified. The public security advisory was issued on September 2, 2026.

As of September 4, Cisco said it was not aware of malicious exploitation, and CISA’s vulnerability enrichment data classified exploitation as none while describing the issue as automatable with total technical impact.

There was also no confirmed public CVE-2026-20212 PoC identified in Cisco’s disclosure or the two requested reports. The absence of public exploit code should not significantly reduce remediation priority, however, because the basic network exposure and vulnerable ports are already publicly documented.

Cisco has not published campaign-specific CVE-2026-20212 IOCs, which is expected because no attacks have been confirmed. Defenders should instead focus on attempts to access TCP 43210 or 43211, Live Protect events, unexpected S1HAL instability, and unauthorized changes occurring on affected devices.

CVE-2026-20212 Mitigation

Cisco has released fixed NX-OS software and strongly recommends upgrading affected Nexus switches. Rather than publishing a single fixed-version table in the advisory, Cisco directs customers to its Software Checker, which identifies whether a specific NX-OS version is affected and returns the earliest fixed release for that platform.

Administrators should therefore:

1. Run show module to identify the switch model.
2. Confirm whether its PID appears in Cisco’s vulnerable-product list.
3. Determine the installed NX-OS release.
4. Use Cisco Software Checker to identify the appropriate fixed release.
5. Upgrade affected systems as soon as operationally possible.

For organizations that cannot immediately upgrade, Cisco provides an infrastructure access control list workaround. Administrators can configure iACLs to allow only required management and control-plane traffic or explicitly deny TCP traffic destined for a locally configured switch address on ports 43210 and 43211.

Cisco states that the workaround was successfully validated in a test environment, but organizations should evaluate its effect on their individual network design before deployment. Network-level mitigations can affect expected functionality when applied without considering local architecture.

Cisco has additionally released Live Protect shield lp00031 as a temporary mitigation. The shield blocks attempts to exploit CVE-2026-20212 while administrators prepare a full software upgrade. Cisco emphasizes that Live Protect is a bridge to patching rather than a permanent remediation.

The Live Protect documentation provides a useful security signal as well. Administrators can verify that the shield is in enforcement mode with:

show nxsecure policy status

They can inspect recorded events using:

show nxsecure log lp00031

When the shield blocks activity targeting the vulnerability, NX-OS can generate a critical NXSECURE syslog indicating a hit against CVE-2026-20212.

For affected systems running NX-OS 10.6(3), Cisco documents support for shield lp00031. A separate package is available for the N9324C-SE1U and N9348Y2C6D-SE1U Smart Switches running 10.6(3s). Cisco’s shield documentation states that the mitigation transitions to N/A when upgrading to NX-OS 10.6(4) or higher, but customers should still use Software Checker to confirm the correct fixed release for their specific hardware and software combination.

CVE-2026-20212 detection should start with identifying affected hardware and monitoring access to the two exposed service ports. Network telemetry, ACL logs, NetFlow data, switch logs, and intrusion detection systems can help identify suspicious attempts to reach TCP 43210 or 43211.

To Detect CVE-2026-20212 exploitation attempts or related compromise, defenders should investigate:

• Unexpected inbound connections to TCP ports 43210 or 43211
• Live Protect lp00031 hit events
• %APPMGR-2-NXSECURE_CRIT_THREAT messages associated with the vulnerability
• Unexpected crashes or restarts of the S1HAL process
• Unplanned Nexus switch reloads
• Administrative or configuration changes without a corresponding authorized activity
• New or unusual processes running on the switch
• Unexpected outbound connections originating from the network device
• Changes to access-control, routing, forwarding, or management configuration
• Attempts to disable logging or security controls following suspicious network traffic

Cisco has also published Snort Rule 67005 in connection with the advisory, providing another detection option for organizations using compatible Cisco security tooling.

If suspicious activity is identified on an unpatched switch, defenders should treat the event as potentially serious because exploitation provides root privileges. Incident response should include configuration validation, administrative account review, log preservation, comparison against known-good device state, and investigation of systems communicating with the affected switch.

The CVE-2026-20212 mitigation priority should be particularly high for devices whose affected ports are reachable from user segments, externally accessible networks, or other untrusted infrastructure. Blocking the ports can substantially reduce immediate exposure, but upgrading to Cisco’s fixed software remains the vendor-recommended permanent solution.