CVE-2026-20212 affects 10 Silicon One–based Nexus 9000 switches and can let an unauthenticated, remote attacker execute code as root, Cisco says.
CVE-2026-20212: what the Nexus 9000 flaw does
Cisco disclosed CVE-2026-20212 on September 2 and has released patches for affected devices. The defect is a case of binding to an unrestricted IP address that leaves TCP ports 43210 and 43211 reachable in the default Layer 3 virtual routing and forwarding (VRF) instance. An attacker who can reach a switch's address on either port can connect directly to the service; crafted input sent to that service is executed as code with root privileges. Cisco also warns that an exploitation attempt can crash the S1HAL process and reload the device.
Cisco said it is not aware of any malicious use of the flaw as of its September 2 disclosure.
Affected Nexus models and release scope
Cisco lists ten affected product identifiers (PIDs) for the Nexus 9000 advisory, checkable against the output of the show module command: N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Other Nexus 9000 models, Nexus 9000 fabric switches running in Application Centric Infrastructure (ACI) mode, and the Nexus 3000 and 7000 lines are unaffected.
The Hacker News confirmed via the CVE Program's record on September 3 that Cisco lists 45 NX-OS releases, from 10.3(1) through 10.6(3s), as affected; the advisory directs customers to Cisco's Software Checker for precise guidance on fixed releases.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCisco mitigations: Software Checker, iACLs, and Live Protect
Until a fixed release is confirmed, Cisco offers three primary mitigations. First, upgrade to the release named by Cisco's Software Checker; Cisco notes the Live Protect shield's release notes state that its operational mode transitions to N/A on upgrade to NX-OS 10.6(4) or higher. Second, use an infrastructure access control list (iACL) permitting only required management and control-plane traffic, or explicitly deny TCP packets to a locally configured IP address on destination port 43210 or 43211 — Cisco reports that an iACL was proven in a test environment. Third, deploy the temporary Live Protect shield lp00031 described in Cisco's Live Protect documentation. That shield is supported only on NX-OS 10.6(3) and, via a second shield package, on 10.6(3s) for the two Smart Switches; it is unsupported on the Nexus 9804 and 9808 and requires SSH, Telnet, or NX-API access.
IOS XR hardening release: seven umbrella CVEs and SMU guidance
On the same day Cisco published an IOS XR hardening release that bundles seven umbrella CVEs. Two of those umbrella records, CVE-2026-20274 (memory-safety and resource-lifetime bugs) and CVE-2026-20279 (access-control bugs including missing authentication for critical functions and improper certificate validation), each carry a 9.8 ceiling. The remaining five CVEs — CVE-2026-20275 through CVE-20278 and CVE-2026-20280 — top out between 8.2 and 8.8. Cisco's advisory says the vulnerabilities affect all releases regardless of device configuration.
Cisco told IOS XR customers, including those on IOS XR7 (LNT), to upgrade to a release that includes software maintenance updates (SMUs) and then apply the SMUs. Cisco listed SMUs for specific releases (for example: 6.9.2; 7.3.2; 7.9.2; 7.9.21; 7.10.2; 7.11.2; 7.11.21; 24.2.2; 24.2.21; 24.4.2; 25.2.21; 25.4.1; 25.4.2; 26.1.2; and 26.2.1) and indicated SMUs are future releases for several others. The XR7 (LNT) platforms have a dedicated SMU CSCwv19790, applicable on all releases. Cisco said there may be “approximately 16 SMUs available for each release,” and that future releases 26.2.2 and 26.3.1 will be the first fixed releases needing no SMUs.
The Hacker News cross-checked the seven CVE records on September 3 and found that, of the 111 IOS XR releases Cisco lists as affected, 14 have SMUs available today, four are awaiting SMUs, and 93 must first be upgraded before a fix can be applied.
What this means for network operators, IOS XR customers, and threat hunters
- Network operators and security teams: confirm whether any listed Nexus PIDs exist in inventories, check NX-OS versions against Cisco's Software Checker, apply iACLs that deny TCP destination ports 43210/43211 where practical, and deploy Live Protect where supported.
- IOS XR customers and procurement leaders: follow Cisco's upgrade-and-apply-SMU guidance — upgrade to a release that includes SMUs and then install the SMUs listed for your platform. Customers running releases outside Cisco's table should open a Technical Assistance Center (TAC) case, Cisco said.
- Threat hunters and incident responders: note Sygnia's recent Fire Ant findings cited by Cisco — implants on IOS XR routers suppressed syslog delivery, filtered show command output, supported a hidden Generic Routing Encapsulation (GRE) tunnel, captured packets uploaded to external FTP servers, and performed connection attempts and port scans against connected systems. Sygnia's investigation began with a tunnel interface active on a router that had no running configuration or commit history to explain it; Sygnia did not identify how the actor first gained access or name any vulnerability.
Cisco published the disclosures while saying it is not aware of active exploitation of CVE-2026-20212. As Russ Smoak, vice president of information security at Cisco, put it in a June blog post about the company's disclosure cadence: "At the same time, the window between disclosure and exploitation has effectively closed." Network teams now face a twofold task: patch and harden devices per Cisco's guidance, and hunt for signs of the covert activity Sygnia described that could indicate undetected compromise.
