CVE-2026-20212

CRITICAL 9.8

Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

CWE	CWE-1327
Vendor	cisco
Product	cisco nx-os software
Ecosystems	Networking
Industries	NetworkingTelecommunications
Published	Sep 2, 2026
Last Updated	Sep 3, 2026

Stay Ahead of the Next One

Get instant alerts for cisco cisco nx-os software

Be the first to know when new critical vulnerabilities affecting cisco cisco nx-os software are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Cisco / Cisco NX-OS Software

10.3(1) 10.3(2) 10.3(3) 10.4(1) 10.3(99w) 10.3(3w) 10.3(99x) 10.3(3o) 10.3(4) 10.3(3p) 10.3(4a) 10.4(2) 10.3(3q) 10.3(5) 10.4(3) 10.3(3x) 10.3(4g) 10.5(1) 10.3(3r) 10.3(6) 10.4(4) 10.3(4h) 10.5(2) 10.3(7) 10.4(5) 10.5(3) 10.4(4g) 10.5(4) 10.6(1) 10.5(3t) 10.3(8) 10.4(6) 10.5(3s) 10.5(3e) 10.5(3o) 10.6(1s) 10.6(2) 10.5(3p) 10.3(9) 10.6(2s) 10.6(3) 10.4(7) 10.5(5) 10.6(2n) 10.6(3s)

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sec.cloudapps.cisco.com: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr