Critical Cisco Nexus 9000 Flaw Enables Remote Code Execution With Root Privileges

Cisco has fixed a critical vulnerability, CVE-2026-20212 (CVSS 9.8), affecting ten Nexus 9000 switches built on Silicon One. The problem stems from a service binding to an unrestricted IP address: as a result, TCP ports 43210 and 43211 remain reachable in the default VRF instance at L3.

Anyone who can reach the switch's address on one of these ports connects to the service directly. Specially crafted data is then executed as code with root privileges. In addition, an exploitation attempt can crash the S1HAL process and reboot the device. As of the September 2 disclosure, Cisco had no evidence of the flaw being exploited maliciously.

Who Is Affected

The advisory lists specific models — among them the Nexus Smart Switch (N9324C-SE1U, N9348Y2C6D-SE1U), the N9364E-SG2 series, and the N9K-C9804 and N9K-C9808. Other Nexus 9000 models, switches running in ACI mode, and the Nexus 3000 and 7000 lines are not affected. Forty-five NX-OS releases are listed as vulnerable — from 10.3(1) through 10.6(3s) — but Cisco recommends confirming the exact list through its Software Checker.

The company has not published a single table of fixed versions. As interim measures, it suggests an infrastructure ACL to block the two ports and the Live Protect “shield” (lp00031) — though the latter is supported only on select versions and requires access via SSH, Telnet, or NX-API, and is unavailable on the 9804 and 9808.

The IOS XR Hardening Release

In parallel, a “hardening” release for IOS XR went out, bundling seven so-called umbrella CVEs. Each covers a separate category of defects and is scored according to the most severe among them. Two vulnerabilities — CVE-2026-20274 (memory safety issues) and CVE-2026-20279 (access control errors, including missing authentication for critical functions) — reach the ceiling of 9.8. The remaining five are rated between 8.2 and 8.8.

The catch is that the vulnerabilities affect all versions of IOS XR regardless of the device's configuration, and there is no workaround for any of them. Of the 111 affected releases, patches (SMUs) are available today for only fourteen; another four are awaiting fixes, and 93 first require an upgrade. The first fully patched releases that won't need an SMU applied will be the upcoming 26.2.2 and 26.3.1.

This is already the third scheduled “hardening” release in 30 days under the new disclosure model that Cisco's VP of security Russ Smoak wrote about back in June: the window between disclosure and exploitation “has effectively closed.”

A Worrying Context

The publication came six days after a report by Sygnia on the Chinese group Fire Ant, which had been running purpose-built implants on IOS XR routers: they suppressed syslog transmission, filtered the output of show commands, and maintained a covert GRE tunnel. The attackers intercepted traffic and exfiltrated it to external FTP servers. The investigation began with the discovery of an active tunnel interface on a device whose configuration did nothing to explain it — which, according to Sygnia, meant that the device's actual state could no longer be trusted. Exactly how initial access was obtained could not be determined.

Source: The Hacker News