Critical vulnerability in Cisco Nexus 9000: Risk of remote system takeover

Cisco has issued an urgent advisory regarding an exceptionally critical security vulnerability affecting its Nexus 9000 series switches. Carrying a near-perfect Common Vulnerability Scoring System (CVSS) score of 9.8/10, this flaw could allow remote attackers to easily breach and gain full control of the device without requiring any account authentication.

Details of the vulnerability and exploitation methods

Tracked as CVE-2026-20212, the vulnerability was discovered by Cisco's team during a Technical Assistance Center (TAC) support case for a customer. Fortunately, to date, the company has found no evidence indicating that this vulnerability is being actively exploited in the wild.

CVE-2026-20212 vulnerability in Cisco Nexus 9000

The root cause lies in how the device manages virtual networks. Specifically, the default configuration of the Layer 3 Virtual Routing and Forwarding (Layer 3 VRF - a technology used to segregate independent virtual network traffic) feature inadvertently leaves TCP ports 43210 and 43211 exposed.

Exploiting this flaw, an attacker simply needs to connect to the device's IP address via one of these two ports and send crafted malicious data or commands. If successful, the code will be executed with "root" privileges – the highest level of administrative control on the system.

Once in control of the core system, hackers can freely tamper with network configurations, steal data, monitor traffic streams, or even worse, crash a critical process named S1HAL, causing the device to reload and resulting in a full network outage.

Affected devices

Despite its high severity, not all Cisco devices are affected. The vulnerability specifically targets 10 switch models in the Nexus 9000 series equipped with Silicon One Application-Specific Integrated Circuit (ASIC) chips, such as the N9324C-SE1U, N9336C-SE1, or N9K-C9808 models. To be certain, administrators can execute the "show module" command directly on the device to cross-reference product codes with the official advisory list provided by the company.

The good news for enterprise networks is that other product lines, including Nexus 3000, Nexus 7000, Firepower firewalls, or Nexus 9000 switches running in Application Centric Infrastructure mode (ACI mode), are completely immune to this vulnerability.

www.ipsip.vn

VMSA-2026-0006: Up to 3 VMware vulnerabilities are rated as "Critical"

Broadcom has officially released VMware Security Advisory (VMSA-2026-0006) to urgently address 5 vulnerabilities across several of its software product lines. Notably, up to 3 vulnerabilities are rated as "Critical".

Urgent mitigation recommendations from Cisco

The most permanent and secure solution at this time is for organizations to promptly upgrade the device's NX-OS operating system to a patched version using Cisco's Software Checker tool.

However, if the system cannot be upgraded immediately, the vendor provides several temporary workarounds:

• Applying Infrastructure Access Control Lists (iACLs): Administrators should configure iACLs to proactively block all incoming TCP packets targeting ports 43210 and 43211 on the switch's internal IP addresses.

• Enabling Live Protect: This is a temporary shield-like protection tool provided by Cisco that mitigates exploitation attempts targeting the vulnerability until the software can be fully updated.

Notably, alongside the fixes for the Nexus 9000 series, Cisco has also released a series of patches for its IOS XR routing operating system, addressing two other security vulnerabilities that also reach the maximum score of 9.8. This series of incidents serves as a wake-up call for organizations and enterprises to urgently audit their entire network infrastructure to avoid becoming targets for cybercriminals.

---

Refer to: The Hacker News