CVE-2026-20212: Cisco Nexus 9000 Unauthenticated Remote Code Execution, CVSS 9.8
Cisco disclosed CVE-2026-20212 in Nexus 9000 switches, CVSS 9.8. Unauthenticated remote attackers can execute arbitrary code as root via specific TCP ports. Multiple Silicon One ASIC models affected.
Cisco disclosed a critical Nexus 9000 vulnerability on September 2: CVE-2026-20212. An unauthenticated remote attacker can send crafted packets to specific TCP ports on affected devices and execute arbitrary code as root. CVSS 9.8. Multiple data-center switch models with Silicon One ASICs are in scope.
Incident Overview
Affects selected Nexus 9000 models with Silicon One ASICs, including N9324C-SE1U, N9348Y2C6D-SE1U, and others listed in Cisco's advisory. Attack surface is network-layer: no credentials. Malicious packets to TCP 43210 and 43211 trigger the bug. Cisco also notes successful exploitation can interrupt device operation and produce a denial-of-service state.
Technical Details
Insufficient validation of inbound packets in a device network service. Crafted packets reach privileged low-level processing and execute as root. TCP 43210/43211 are internal service ports and should not be exposed to untrusted networks in normal operations. Many data-center switches have loose boundaries between management and production segments; an attacker who reaches an adjacent segment can hit the ports. Cisco reports no observed malicious exploitation and no public exploit code yet. Data-center core-device vulns typically get weaponized quickly once details spread.
Impact Assessment
Nexus 9000 is a primary fabric switch for AI data centers and HPC clusters. Device compromise lets an attacker alter routing and ACLs, redirect traffic, and sniff east-west data—below the visibility of most EDR and host security products. Unauthenticated remote root RCE is emergency-priority for data-center networks.
Remediation
- Confirm model against Cisco's affected list. Upgrade to the fixed release for each train as soon as possible.
- If upgrade is delayed: infrastructure ACLs (iACL) strictly limiting sources that can reach TCP 43210/43211.
- Isolate the switch management plane onto a dedicated management VLAN or OOB network. Do not allow production segments to reach device service ports.
- Detection: monitor anomalous connection attempts to 43210/43211; watch unauthorized config changes and unexpected reboots.
Sources
- CVE-2026-20212 details
- ThreatCluster: Cisco Nexus 9000 critical vulnerability analysis