Critical severity · published Sep 2, 2026
CVE-2026-20212
Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.
This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CN
Cisco NX-OS Software · Cisco
10.3(1); 10.3(2); 10.3(3); 10.4(1); 10.3(99w); 10.3(3w); +34 more · source: vendor
In the news
VulnerabilityCritical
Cisco Fixed Critical RCE in Nexus 9000 Series Switches
Cisco patched a critical Nexus 9000 vulnerability, CVE-2026-20212, allowing unauthenticated remote root code execution. Cisco has released patches for a critical flaw, tracked as tracked as CVE-2026-20212 (CVSS score of 9.8) in 10 Silicon One-based Nexus 9000 switches. The vulnerability could let an unauthenticated remote attacker execute code with root privileges. Cisco’s Technical Assistance Center […]
Sep 3, 2026·Security Affairs
VulnerabilityCritical
Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround for any IOS XR version.
The Nexus vulnerability, tracked as CVE-2026-20212 (CVSS score: 9.8), is
Sep 3, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20212
sec.cloudapps.cisco.com
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr
More from Cisco NX-OS Software
6.7
CVE-2024-20399
Cisco NX-OS Software CLI Command Injection Vulnerability
9.8
CVE-2026-76501
Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76486
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76485
Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
9.8
CVE-2026-76459
Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities