Skip to content

Cisco Nexus 9000 CVE-2026-20212: unauthenticated root RCE on 10 Silicon One-based switches — plus a 7-CVE IOS XR hardening release

Tags

Summary

On September 3, 2026, The Hacker News reported that Cisco released patches for a critical, unauthenticated remote code-execution flaw affecting 10 Silicon One-based Nexus 9000 switches — CVE-2026-20212 (CVSS 9.8) — that lets a remote attacker with no credentials execute code as root on the switch. The flaw is a binding to an unrestricted IP address that leaves TCP ports 43210 and 43211 reachable in the default Layer 3 virtual routing and forwarding (VRF) instance: an attacker who can reach a switch's address on either port connects directly to the service, and crafted input sent to it executes as code with root privileges. An exploitation attempt can also crash the S1HAL process and reload the device.

Cisco said it was not aware of any malicious use of the flaw as of its September 2, 2026 disclosure. Cisco published no fixed-release table; the CVE program record lists 45 NX-OS releases from 10.3(1) through 10.6(3s) as affected, and customers are pointed to the Cisco Software Checker. Interim mitigations: an infrastructure access control list (iACL) blocking TCP 43210/43211 and a temporary Live Protect shield.

The same window carried an IOS XR hardening release bundling 7 umbrella CVEs, 2 of them rated 9.8, with no workaround for any IOS XR version: - CVE-2026-20274 — memory-safety and resource-lifetime bugs (9.8 ceiling). - CVE-2026-20279 — access-control bugs including missing authentication for critical functions and improper certificate validation (9.8 ceiling). - CVE-2026-20275 through CVE-2026-20278 and CVE-2026-20280 — the remaining five, topping out between 8.2 and 8.8.

The vulnerabilities affect all IOS XR releases regardless of device configuration. The XR7 (LNT) platforms — Cisco 8000 Series, NCS 1010, NCS 540L, NCS 5700 Series — have a dedicated SMU that applies across them. Cisco's guidance: upgrade to a release that includes software maintenance updates (SMUs), then apply them.

The umbrella-CVE model is structural: Cisco groups internally found bugs by Common Weakness Enumeration bucket, assigns one CVE per bucket, and scores it at the most severe defect in the bucket. Russ Smoak, VP of information security at Cisco, said in the June blog post announcing the twice-monthly disclosure model that "the window between disclosure and exploitation has effectively closed."

Affected scope

  • Nexus 9000 (Silicon One): 10 switch models (PIDs checkable against show module output). Other Nexus 9000 models, Nexus 9000 fabric switches running in Application Centric Infrastructure (ACI) mode, and the Nexus 3000 and 7000 lines are not affected.
  • NX-OS: 45 releases, 10.3(1) through 10.6(3s), per the CVE program record; the advisory itself defers to the Software Checker for the fixed-release table.
  • IOS XR: all releases, all configurations; XR7 (LNT) has a dedicated SMU.

Mitigations and response

  1. Nexus 9000: deploy an iACL blocking TCP 43210 and 43211 and enable the temporary Live Protect shield until a fixed NX-OS release is confirmed in the Software Checker.
  2. IOS XR: upgrade to a release with the hardening SMUs and apply them; there is no configuration-based workaround.
  3. Check affected PIDs against show module output on each device; inventory which of the 45 NX-OS releases are in use.
  4. Preserve device logs and S1HAL crash/reload events around the disclosure window for forensic correlation.

Detection / defensive heuristics

  • Alert on any TCP connection attempts to ports 43210 or 43211 on Nexus 9000 devices — legitimate traffic on these ports in the default L3 VRF is not expected; treat any hit as a probable exploitation attempt.
  • Correlate S1HAL process crashes and unexplained device reloads with external connection attempts to those ports.
  • For IOS XR: review the SMU install status on every release; an unpatched appliance in the affected range is a standing unauthenticated root-RCE risk with no compensating control.
  • Data-center and WAN teams should treat the iACL as a stopgap, not a fix: it blocks the two ports but does not remediate the binding defect.

Why this matters

  • Unauthenticated, remote, root. No credentials, no special configuration, no ACI mode — a switch that is reachable on two ports is exploitable to root. That is the highest-consequence class of network-device flaw.
  • No fixed-release table at disclosure. The Software-Checker-only remediation path, combined with 45 affected releases, makes patch tracking a manual, error-prone task during the exploitation window Cisco's own disclosure model declares closed.
  • Umbrella CVEs are the new normal. The IOS XR 7-CVE hardening release (two at 9.8, no workaround) shows that "one CVE per CWE bucket" disclosure bundles a wide fix surface under a small number of identifiers — defenders must read the advisory, not the CVE count, to size exposure.

Assessment limits

  • No confirmed malicious use as of Cisco's September 2 disclosure; the exploit window is assumed-open, not observed.
  • The fixed-release table is not public; affected-version verification depends on the Software Checker.
  • The 45-release NX-OS range is from the CVE program record (confirmed by The Hacker News on September 3), not a table published in the advisory.

  • Umbrella-CVE scoring (9.8 ceilings on CVE-2026-20274 / CVE-2026-20279) reflects the most severe defect in each bucket, not every underlying bug.

  • Plex patch-window context: the same September 2026 window carried Plex's "update immediately" advisory (Plex Media Server 1.43.3 / Plex Desktop 1.115.0 patching multiple undisclosed flaws, CVEs requested; 360,000+ internet-exposed instances per Censys; history of exploitation including the 2022 LastPass intrusion via CVE-2020-5741). Network and home-media infrastructure patching urgency is elevated across the window; see the Plex THN report.

Sources