Critical Cisco Nexus 9000 Vulnerability Allows Remote Code Execution

On September 2, 2026, Cisco disclosed CVE-2026-20212, a critical vulnerability in Nexus 9000 switches using Silicon One ASICs. This flaw enables unauthenticated remote attackers to execute code with root privileges via TCP ports 43210 and 43211. The vulnerability has a CVSS score of 9.8 and could lead to device outages and denial-of-service conditions. Cisco's advisory indicates that the exposure risk is significant, especially in compromised internal networks. Although no exploitation has been reported yet, organizations are urged to apply patches or implement workarounds immediately. The affected models include N9324C-SE1U, N9348Y2C6D-SE1U, and others listed in the advisory. Cisco recommends using infrastructure access control lists (iACLs) to mitigate risks until patches can be applied. The vulnerability is particularly concerning for AI data centers relying on these switches for high-performance computing.

Key Points: • CVE-2026-20212 allows unauthenticated remote code execution on Cisco Nexus 9000 switches. • The vulnerability has a CVSS score of 9.8 and affects specific models with Silicon One ASICs. • Cisco recommends immediate patching or implementing iACLs to mitigate the risk.