Critical [CVE-2026-20212] Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
This critical-severity Cisco advisory covers CVE-2026-20212 affecting NX-OS Software, Nexus 9000 Series Switches.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.
This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges.
The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.
Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.
Affected products named by the advisory: NX-OS Software.
- Scope: This vulnerability affects Cisco Nexus 9000 Series Switches if they include a Silicon One ASIC.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- There is a workaround that addresses this vulnerability.
- To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211.
- For more information about iACLs, see the Cisco NX-OS Software Hardening Guide.
- While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer depl…
- Live Protect Shields
- Cisco has released a Live Protect shield for CVE-2026-20212 to temporarily mitigate this vulnerability in Cisco NX-OS Software.
- For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide.
- Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.