Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without Authentication

Cisco has released security updates addressing a critical vulnerability in Nexus 9000 Series switches that could allow unauthenticated remote attackers to execute arbitrary code with root privileges.

This vulnerability, tracked as CVE-2026-20212, has a CVSS score of 9.8 and affects Nexus 9000 platforms that are equipped with Cisco Silicon One ASICs.

Cisco Nexus 9000 Flaw

According to Cisco’s advisory, the issue originates from the integration of Silicon One in the affected Cisco NX-OS deployments.

TCP ports 43210 and 43211 are accessible through the default Layer 3 virtual routing and forwarding (VRF) instance, creating a network-reachable attack surface that does not require valid device credentials.

An attacker could exploit this vulnerability by connecting to an exposed Nexus switch and sending specially crafted input to the vulnerable service. Successful exploitation could allow code execution with root privileges, granting the attacker the highest level of access on the network device.

In addition to the potential for complete device compromise, Cisco has warned that exploiting this vulnerability may also crash the S1HAL process. A crash of this process could force the affected Nexus switch to reboot, leading to a denial-of-service condition alongside the risk of unauthorized root-level command execution.

Affected Nexus Platforms

The vulnerability impacts Cisco Nexus 9000 Series Switches that include a Silicon One ASIC. Cisco has listed several potentially affected product identifiers, including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808.

Administrators can identify their device model by using the `show module` command in the NX-OS command-line interface. Cisco has confirmed that only the Nexus 9000 devices specifically identified in its advisory are known to be vulnerable.

Nexus 9000 switches not included in the affected list are not vulnerable. Nexus 9000 Fabric Switches operating in ACI mode are also unaffected. Other confirmed unaffected products include Nexus 3000, Nexus 7000, MDS 9000, Firepower appliances, Secure Firewall platforms, and several UCS Fabric Interconnect models.

Cisco has released software updates and strongly recommends upgrading to a fixed Cisco NX-OS release as a permanent solution. Organizations can use Cisco Software Checker to determine if their deployed NX-OS version is affected and to find the earliest fixed release compatible with their hardware and software combination.

Until upgrades can be scheduled, Cisco recommends implementing infrastructure access control lists (iACLs) to restrict traffic reaching the switch control plane. Administrators should permit only essential management and control-plane communications or explicitly deny TCP traffic directed to locally configured IP addresses on ports 43210 and 43211.

Additionally, Cisco has issued a Live Protect shield for CVE-2026-20212 as a temporary mitigation. However, Live Protect and iACL-based controls should be considered interim measures rather than replacements for patching.

As of the advisory’s publication on September 2, 2026, Cisco PSIRT reported no known instances of public exploitation or malicious use of CVE-2026-20212. This vulnerability was discovered during the resolution of a support case at the Cisco Technical Assistance Center.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.