CVE-2026-20212 carries a CVSS of 9.8: unauthenticated remote code execution as root on Silicon One-based Cisco Nexus 9000 switches.

The cause is not exotic. The S1HAL process binds to an unrestricted IP address, which leaves TCP ports 43210 and 43211 reachable in the default Layer 3 VRF. Anyone who can route to the switch on those ports talks straight to the service.

That is the whole bug: a listener that listens too widely.

There is no fixed release

Affected models are the N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804 and N9K-C9808 — ten of them.

Affected NX-OS runs from 10.3(1) through 10.6(3s). That is every release in the range, and the advisory lists no fixed release.

What is on offer instead:

  • An infrastructure ACL blocking 43210 and 43211.
  • Cisco Live Protect shield lp00031 — described as temporary, and unsupported on the N9804 and N9808.

Read that last clause again. The two largest chassis in the affected list get the ACL and nothing else. For those operators the mitigation is entirely their own network design, on a flaw that grants root without credentials.

Why the exposure is smaller than 9.8 suggests, and why that is cold comfort

A CVSS 9.8 assumes network reachability. In practice a data-centre switch's management and control interfaces are usually not reachable from anywhere an attacker starts, which is why the practical risk here is lower than the number implies.

But "usually not reachable" is doing the work, and the default VRF is precisely where the assumption tends to be wrong — that is the routing instance that carries production traffic on a lot of estates, not a segregated management plane.

The honest question is not "is my switch on the internet". It is "can anything that gets a foothold anywhere on my network reach TCP 43210 on this box". For a flat network the answer is yes, and the flaw then converts any foothold into root on the switch that moves everyone else's packets.

Not in KEV, and Nexus rarely is

We checked the feed directly. As of the 2 September 2026 catalogue — 1,694 entries — CVE-2026-20212 is not in KEV, and neither are the two CVSS 9.8 flaws Cisco shipped alongside it in the IOS XR hardening release, CVE-2026-20274 and CVE-2026-20279.

Cisco says it is not aware of any malicious use.

Some context from the same feed, because it changes how you should read that. Cisco has 96 entries in KEV — more than any vendor this site checks regularly. Exactly one is Nexus or NX-OS: CVE-2024-20399, added in July 2024. Everything else clusters in firewalls, VPN and management software: ASA and FTD, Firewall Management Center, Unified Communications Manager, Catalyst SD-WAN Manager.

Switches are not where Cisco's exploited flaws have historically been. That is a reason to think this one may stay unexploited — and it is also the reason nobody is watching switch telemetry with the attention they give the edge.

One entry in that list is worth noticing on its own: CVE-2008-4128, an IOS flaw, added to KEV on 13 July 2026. An eighteen-year-old vulnerability, catalogued as known-exploited this year.

What to do

  • Apply the ACL now. Block 43210 and 43211 at the infrastructure boundary. It is the only remedy available to every affected model.
  • Deploy lp00031 if you are not on a 9804 or 9808 — and treat it as temporary, because Cisco does.
  • Check which VRF your management traffic actually uses. The flaw is exposed in the default L3 VRF; if that is also your production routing instance, your blast radius is the whole fabric.
  • Do not wait for a fixed release to plan. There is no date attached to one.
  • Patch the IOS XR batch too. Two more 9.8s shipped the same day and they will get less attention than this one.

What is not established

  • When a fixed release arrives. The advisory does not say.
  • Whether the flaw is being exploited. Cisco says it is unaware of any malicious use; absence of evidence, as always.
  • Who found it. No researcher credit is given.
  • How many affected switches are reachable from an untrusted network. Nobody has published a scan.
  • Whether lp00031 fully mitigates, as distinct from reducing exposure. "Temporary" is the vendor's word, not a technical description.