Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-20212 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-02 |
| Vendor | Cisco |
| Product | Nexus 9000 Series Switches (with Silicon One ASIC) |
| CVSS Score | 9.8 (critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Cisco Bug ID | CSCwu32817 (CWE-1327) |
| Workaround | Yes (see Cisco advisory) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
A vulnerability in the Silicon One integration on Cisco Nexus 9000 Series Switches allows an unauthenticated, remote attacker to execute code with root privileges.
The root cause is that TCP ports 43210 and 43211 are reachable in the default Layer 3 VRF (virtual routing and forwarding). An attacker with network access to those ports can connect to the device and send crafted input that is executed as code with root privileges. Successful exploitation can also crash the S1HAL process, which in turn can cause the switch to reload.
The CVSS vector AV:N/AC:L/PR:N/UI:N describes the worst possible set of conditions:
network-reachable, low complexity, no privileges required and no user interaction.
There is no step here that the attacker has to negotiate through social engineering.
Why this is more serious than a typical server flaw. A Nexus 9000 is a data centre core switch — the device all of the environment’s traffic passes through. Root on it is not “one compromised host”: it is the ability to redirect and intercept traffic, bypass the network segmentation most access control models rest on, and persist in a place a typical EDR cannot see. The alternative outcome — a device reload — means an availability outage for an entire network segment.
Required Actions
-
Determine whether your device contains a Silicon One ASIC. The vulnerability affects only Nexus 9000 switches with that chip. Cisco lists the product identifiers (PIDs):
N9324C-SE1U,N9348Y2C6D-SE1U,N9364E-SG2-O,N9364E-SG2-Q,N9396T12C-SE1,N9348Y12C-SE1,N9396Y12C-SE1,N9336C-SE1,N9K-C9804,N9K-C9808. Check your device with:switch# show module -
Upgrade the software to a release listed in the Fixed Software section of the Cisco advisory. The list of fixed releases is maintained by Cisco and gets updated — check it directly in the advisory, not in secondary sources.
-
Until you patch, restrict network access to TCP ports 43210 and 43211. Cisco confirms a workaround is available (Workarounds: Yes) — apply it exactly as worded in the advisory. Treat it as a temporary measure, not a substitute for the patch.
-
Verify where those ports are reachable from. Since they are exposed in the default Layer 3 VRF, the key question is who has a route to the switch management addresses. If the management plane is not separated from the production network, this flaw is reachable from inside the network via any compromised host.
-
Review logs for S1HAL process crashes — unexpected device reloads may be traces of exploitation attempts.
Who Is Affected?
The vulnerability affects Cisco Nexus 9000 Series Switches equipped with a Silicon One ASIC, regardless of device configuration as far as this vector is concerned.
Cisco confirms the vulnerability does NOT affect: Nexus 9000 Series Fabric Switches in ACI mode, Nexus 9000 models outside the PID list in the advisory, the Nexus 3000 and Nexus 7000 series, MDS 9000 Series Multilayer Switches, and Firepower 1000/2100/4100 Series, Firepower 9300 and Secure Firewall 200/1200/3100/4200 Series appliances.
In practice this alert concerns organisations running their own data centre on Cisco hardware — in Poland primarily financial services, telecoms, energy and larger industrial environments.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
