CyberSecurity News

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

The Hacker News

· September 3, 2026

AI summary

Cisco has released patches for a critical security flaw in certain Nexus 9000 switches that could allow remote attackers to execute code with root privileges without authentication. The vulnerability affects 10 Silicon One-based Nexus 9000 switches. Cisco also released an IOS XR hardening update that addresses 7 vulnerabilities, including 2 with a severity rating of 9.8. There is no workaround available for any IOS XR version. The Nexus vulnerability has a CVSS score of 9.8, indicating a high level of severity.

Vulnerabilities mentioned

CVE-2026-20212

CRITICAL

CVSS 9.8

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Read the full article at The Hacker Newsthehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to The Hacker News.