Cisco Patches Critical Nexus 9000 Flaw Enabling Unauthenticated Remote Code Execution
Summary
Cisco patched CVE-2026-20212, which could let unauthenticated attackers run code as root on 10 Nexus 9000 models. It also issued IOS XR hardening fixes and separate Secure Email and phone advisories; no exploitation of the Nexus flaw was known.
Key points
- CVE-2026-20212 affects 10 Silicon One-based Nexus 9000 models; other Nexus 9000 models, ACI-mode fabric switches, and Nexus 3000 and 7000 lines are unaffected.
- The flaw exposes TCP ports 43210 and 43211 in the default Layer 3 VRF. Crafted input to the service could execute code as root or crash the S1HAL process and reload the device.
- Cisco said it knew of no malicious exploitation as of its September 2 disclosure. It directs customers to its Software Checker for fixed releases and offers an iACL or Live Protect shield as temporary mitigations.
- Cisco's IOS XR hardening release groups seven CVEs, two with severity scores up to 9.8. The fixes require software maintenance updates on supported releases; some releases were still awaiting updates.
- Separate advisories address two Secure Email S/MIME decryption flaws and a denial-of-service bug affecting certain Cisco phones.
- Sygnia reported that China-nexus actor Fire Ant used implants on IOS XR routers to suppress logs, filter command output, tunnel traffic, capture packets, and scan connected systems. The initial access method was not identified.
Article Details
- Vulnerability Types
- Unrestricted IP address binding permitting remote unauthenticated code execution as root
- Memory-safety and resource-lifetime bugs
- Access-control flaws, including missing authentication for critical functions and improper certificate validation
- S/MIME decryption flaws allowing a machine-in-the-middle attacker to recover plaintext
- Denial-of-service vulnerability
- Severity
- Critical; CVE-2026-20212 has a CVSS score of 9.8.
- Affected Versions
- NX-OS 10.3(1) through 10.6(3s)
- AsyncOS 16.5.0 or earlier
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Use an infrastructure access control list (iACL) to block TCP ports 43210 and 43211.
- Apply the temporary Live Protect shield lp00031 where supported.
MITRE ATT&CK
T1040 · Network SniffingFire Ant captured packets from routers.T1046 · Network Service DiscoveryFire Ant made port-scan attempts against connected systems associated with critical infrastructure.T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolFire Ant uploaded captured router packets to external FTP servers.T1562.001 · Disable or Modify ToolsFire Ant implants suppressed syslog delivery and filtered show-command output to hide activity on IOS XR routers.T1572 · Protocol TunnelingFire Ant used a hidden GRE tunnel on IOS XR routers to tunnel traffic.
CVE
CVE-2026-20212Cisco has issued urgent fixes for a critical Nexus 9000 flaw, CVE-2026-20212, that could let a remote unauthenticated attacker run code as root on affected Silicon One-based switches.CVE-2026-20274CVE-2026-20274, which covers memory-safety and resource-lifetime bugs, and CVE-2026-20279, which covers access-control bugs including missing authentication for critical functions and improper certificate validation,CVE-2026-20275The remaining five, CVE-2026-20275 through 20278 and CVE-2026-20280, top out between 8.2 and 8.8.CVE-2026-20279CVE-2026-20274, which covers memory-safety and resource-lifetime bugs, and CVE-2026-20279, which covers access-control bugs including missing authentication for critical functions and improper certificate validation,CVE-2026-20280The remaining five, CVE-2026-20275 through 20278 and CVE-2026-20280, top out between 8.2 and 8.8.CVE-2026-20281The same day’s advisories also fixed a phone denial-of-service bug, CVE-2026-20281 (CVSS score: 7.5), in Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices registered to Unified Communications ManagerCVE-2026-20354disclosed Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption flaws in Secure Email, CVE-2026-20354 and CVE-2026-20355 (CVSS scores: 5.9), allow a machine-in-the-middle attacker to recover plaintextCVE-2026-20355Internet Mail Extensions (S/MIME) decryption flaws in Secure Email, CVE-2026-20354 and CVE-2026-20355 (CVSS scores: 5.9), allow a machine-in-the-middle attacker to recover plaintext from mail passing
People
Threat Actors
Vendors
Products
Cisco IOS XR SoftwareThe company also released an IOS XR hardening update covering seven umbrella CVEs, while separate advisories address Secure Email S/MIME decryption issues, a Desk Phone denial-of-service bug, and concerns tied to FireCisco Nexus 9000Cisco has issued urgent fixes for a critical Nexus 9000 flaw, CVE-2026-20212, that could let a remote unauthenticated attacker run code as root on affected Silicon One-based switches.Cisco Secure Emailreleased an IOS XR hardening update covering seven umbrella CVEs, while separate advisories address Secure Email S/MIME decryption issues, a Desk Phone denial-of-service bug, and concerns tied to Fire Ant activityDesk Phone 9800same day’s advisories also fixed a phone denial-of-service bug, CVE-2026-20281 (CVSS score: 7.5), in Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices registered to Unified Communications ManagerIP Phone 7800also fixed a phone denial-of-service bug, CVE-2026-20281 (CVSS score: 7.5), in Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices registered to Unified Communications Manager with Web AccessNX-OSThe Hacker News confirmed via the CVE Program’s record on September 3 that Cisco lists 45 NX-OS releases, from 10.3(1) through 10.6(3s), as affected, a range the advisory itself leaves to the Software Checker.Unified Communications Manager7.5), in Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices registered to Unified Communications Manager with Web Access enabled, a setting that’s off by default.Video Phone 8875bug, CVE-2026-20281 (CVSS score: 7.5), in Desk Phone 9800, IP Phone 7800 and 8800, and Video Phone 8875 devices registered to Unified Communications Manager with Web Access enabled, a setting that’s off