Cisco Releases Security Updates for Cisco NX-OS Software

Successful exploitation of CVE-2026-20212 could allow an remote, unauthenticated attacker to execute arbitrary code with root privileges

Threat ID:: CC-4843
Threat Severity:: Medium
Published:: 3 September 2026 2:58 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-20212 could allow an remote, unauthenticated attacker to execute arbitrary code with root privileges

Affected platforms

The following platforms are known to be affected:

Cisco NX-OS

Cisco Nexus 9000 Series Switches

Note: The vulnerability affects Cisco Nexus 9000 Series Switches if they include a Silicon One ASIC. Please refer to the Vulnerable Products section of Cisco advisory cisco-sa-n9k-s1-rce-EH8dEtr linked below.

Threat details

Introduction

Cisco has released a security advisory to address a critical vulnerability in Cisco NX-OS Software impacting Silicon One integration for Cisco Nexus 9000 Series Switches.

CVE-2026-20212 - 'Binding to an Unrestricted IP Address' vulnerability CVSSv3.1 Score: 9.8.

Remediation advice

Affected organisations are encouraged to review Cisco advisory cisco-sa-n9k-s1-rce-EH8dEtr and apply the relevant update as soon as possible.

Organisations are encouraged to use the Cisco Software Checker tool to determine the latest available version for their deployment.

Definitive source of threat updates

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

CVE Vulnerabilities

Status Published

CVE-2026-20212

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Last edited: 3 September 2026 2:58 pm