- The Mess: Cisco has disclosed a critical flaw in Nexus 9000 switches using Silicon One ASICs that can give an unauthenticated remote attacker root-level code execution. CVE-2026-20212 carries a CVSS score of 9.8, and the vulnerable TCP ports are accessible in the default Layer 3 VRF.
The bug sits in the Silicon One integration inside Cisco NX-OS.
The problem is brutally simple from an attacker’s perspective: TCP ports 43210 and 43211 are accessible in the default L3 VRF. An attacker who can reach an affected switch can send specially crafted input to the exposed service.
No credentials.
No user interaction.
No complicated authentication bypass.
The resulting code executes with root privileges.
Cisco classifies the vulnerability as CWE-1327, “Binding to an Unrestricted IP Address.” The company says the issue was discovered while resolving a customer TAC support case and published the advisory on September 2, 2026.
There is another unpleasant side effect: successful exploitation can crash the S1HAL process and potentially force the switch to reload.
So even an attack that does not result in persistent compromise can still turn into a network outage.
- The Damage: A root compromise of a data-center switch can give an attacker control over a critical piece of network infrastructure and potentially disrupt, manipulate or monitor traffic moving through the environment.
The affected hardware is not every Nexus 9000.
Cisco specifically lists Nexus 9000 models containing the Silicon One ASIC, including:
- N9324C-SE1U
- N9348Y2C6D-SE1U
- N9364E-SG2-O
- N9364E-SG2-Q
- N9396T12C-SE1
- N9348Y12C-SE1
- N9396Y12C-SE1
- N9336C-SE1
- N9K-C9804
- N9K-C9808
Cisco says other Nexus 9000 models are not affected, and Nexus 9000 switches running in ACI mode are also not affected.
The vulnerability is particularly interesting because the attack surface exists at the network layer.
A firewall protecting management access is therefore not just a nice-to-have. If an attacker can reach TCP 43210 or 43211 on an affected device, the exposed service becomes the target.
Cisco has already released a temporary Live Protect shield for the vulnerability. The company also recommends infrastructure ACLs that restrict management and control-plane traffic or explicitly block TCP ports 43210 and 43211 when appropriate.
Cisco stresses that these mitigations are temporary. The proper fix is to move to a software release identified as fixed by the Cisco Software Checker.
One important detail keeps this story from becoming another “hackers are everywhere” headline.
Cisco says its PSIRT is not aware of public exploit code or malicious use of CVE-2026-20212 at the time of publication. The CVE record also currently lists exploitation as none.
That makes this a patch-before-the-exploit story.
- The Fix: Identify affected Silicon One Nexus 9000 switches, block or restrict TCP 43210/43211, deploy Cisco’s temporary protection if needed, and upgrade to a fixed NX-OS release as soon as possible.
Administrators can use the show module command to identify the hardware PID and determine whether the switch is one of the affected models.
Network teams should also review ACLs around these devices rather than assuming that an internal management interface is automatically safe.
The advisory is particularly nasty because the vulnerability has no authentication requirement and no user interaction requirement. Once an attacker has network reachability to the vulnerable service, the CVSS vector gives the flaw maximum impact across confidentiality, integrity and availability.
Cisco has also released a Live Protect shield specifically for CVE-2026-20212. The shield can provide temporary protection while administrators schedule the software upgrade, but Cisco explicitly says it should not replace permanent remediation.
Bugstoday Opinion
This is the kind of vulnerability that makes network engineers uncomfortable.
A web application getting popped is bad.
A server getting popped is worse.
A core switch getting popped as root is where the blast radius starts getting interesting.
CVE-2026-20212 is not being exploited in the wild — at least not according to Cisco right now. That’s good.
But the vulnerability has almost everything an attacker wants: network reachability, low complexity, zero privileges, no user interaction and root execution.
The dangerous part isn’t what attackers are doing today.
It’s what happens after someone turns those two ports into the next mass scanner target.
Patch first.
Ask questions later.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Cisco — Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability
CVE-2026-20212 — CVE Record
Cisco — NX-OS Live Protect Shield Release Notes
Cisco PSIRT — Security Advisory CSCwu32817
