CVE-2026-20212

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Switches (affected versions not specified)

Description A flaw in the Silicon One integration for specific Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. The issue occurs because TCP ports 43210 and 43211 are accessible within the default Layer 3 (L3) virtual routing and forwarding (VRF), which is a virtualized routing table used to isolate network traffic. An attacker can connect to these ports and send crafted input to achieve code execution. Additionally, this may cause the S1HAL process to crash, potentially forcing the device to reload.

Recommendations Upgrade to the fixed NX-OS software release. As a temporary mitigation, use infrastructure ACLs to block unnecessary traffic to TCP ports 43210 and 43211. Apply the Cisco Live Protect Shield as a temporary measure.