CVE-2026-20212

Critical [CVE-2026-20212] Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability

cisco-sa-n9k-s1-rce-EH8dEtrSource published Sep 2, 2026Source updated Sep 2, 2026

An unauthenticated remote attacker could exploit a flaw in the Silicon One integration for Cisco Nexus 9000 Series Switches to execute code with root privileges. Affected products named by the advisory: NX-OS Software.

Affected products in this advisory

• NX-OS Software
• Nexus 9000 Series Switches

Source-reported affected versions

• Scope: This vulnerability affects Cisco Nexus 9000 Series Switches if they include a Silicon One ASIC.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

No mitigation guidance extracted; consult the source.

Workarounds

• There is a workaround that addresses this vulnerability.
• To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211.
• For more information about iACLs, see the Cisco NX-OS Software Hardening Guide.
• While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer depl…

4 more entries in the full advisory.

Advisory [CVE-2026-20212 +10] Cisco Advance Notification for Publication of September 2, 2026, Security Advisories

cisco-sa-notice-f2SiMFxlSource published Aug 26, 2026Source updated Sep 2, 2026

This bulletin covers 11 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco IOS XR Software Security Hardening Release: September 2026 Critical 9.8 Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability High 7.5 Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities Medium 5.9 To remediate the vulnerabilities that were disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more…

Affected products in this advisory

No product details extracted. Check the source bulletin.

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• On September 2, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Desk Phone 9800, 7800 and 8800, and 8875 Series Software IOS XR Software (security hardening release) Nexus 9000 Series Switches Silicon One Secure Email To fully remediate vulnerabilities to be disclosed on September 2, 2026, Cisco strongly recommends that customers upgrade to the fixed software indicated in the advisories.