XHack
Author
Table of Contents
12
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: CVE-2026-20212 is a CVSS 9.8 unauthenticated remote code execution vulnerability in Silicon One ASIC-based Cisco Nexus 9000 switches, disclosed September 2, 2026. The root cause is a classic one: two TCP ports, 43210 and 43211, bind to an unrestricted IP address in the default Layer 3 VRF, which means they’re reachable from anywhere that can route to the switch, not just trusted management infrastructure.
An unauthenticated attacker who reaches either port can send crafted input that gets executed as code with full root privileges, and a failed attempt can crash the switch’s S1HAL process and reload the device outright. Ten switch models are affected, including the high-density N9K-C9804 and N9K-C9808 chassis. Cisco has no known exploitation yet, but shipped fixed NX-OS builds, an infrastructure ACL workaround, and a temporary “Live Protect” shield for switches that can’t patch immediately. If you run Silicon One-based Nexus 9000 hardware, check your exposure today, this isn’t an edge appliance bug, it’s root on your core switching fabric.
Most critical CVEs compromise a server. This one compromises the network the servers sit on. A Nexus 9000 running Silicon One ASICs isn’t a peripheral box, it’s core switching fabric, the thing that decides how every packet in a data center actually moves. Root code execution there isn’t “a finding.” It’s the kind of access that lets an attacker sit invisibly inside the plumbing.
The flaw is disarmingly simple to describe and brutal in practice. TCP ports 43210 and 43211 are reachable through the default Layer 3 virtual routing and forwarding instance on affected switches, and Cisco’s advisory classifies the root cause as CWE-1327, binding to an unrestricted IP address. In plain terms, a service that should only be reachable from trusted internal management infrastructure instead binds to an interface that any device able to route to the switch can reach.
An unauthenticated attacker who can send traffic to either port can submit crafted input that gets executed as code with root-level privileges on the switch, no login, no credentials, no MFA prompt to bypass. The service behind those ports ties into the S1HAL process, the hardware abstraction layer that talks to the Silicon One ASIC itself. That’s also why a failed or malformed exploitation attempt isn’t harmless: it can crash S1HAL and force the device to reload, meaning even an attacker who doesn’t successfully get code execution can still take the switch down.
Cisco says it found the bug internally while resolving a Technical Assistance Center support case, not through external research or a bug bounty submission, and disclosed it as part of its regular twice-monthly vulnerability release cycle rather than as an emergency out-of-band advisory.
A compromised web server gets an attacker that server. A compromised core switch gets them a vantage point over everything that flows through it.
Nexus 9000 switches with Silicon One ASICs sit at the center of high-density data center fabrics, exactly the kind of hardware that carries east-west traffic between the servers, storage, and applications an organization actually cares about protecting. Root access on that hardware means an attacker can potentially intercept, redirect, or drop traffic across the fabric it controls, and do so from a position most security teams aren’t watching nearly as closely as they watch servers and endpoints.
That’s the same structural risk we flagged with the TeamCity RCE chain a few weeks back: the danger isn’t the box itself, it’s everything the box sits in front of. For a build server that’s the software supply chain. For core switching fabric, it’s every packet the data center moves.
Cisco’s own framing of the threat landscape is worth sitting with here too. Cisco VP of Information Security Russ Smoak has noted that the gap between a vulnerability’s disclosure and its weaponization has effectively closed, a reality that shapes why Cisco groups and ships fixes on a predictable twice-monthly cadence rather than trickling out disclosures that give attackers more individual moments to react to. CVE-2026-20212 has no confirmed exploitation yet, but that closing gap is exactly why “no known exploitation as of disclosure” buys defenders days, not months.
Ten Silicon One-based Nexus 9000 models are in scope: N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Notably, that includes the high-capacity N9K-C9804 and N9K-C9808 modular chassis, the switches most likely to sit at the core of a large fabric rather than the edge.
Cisco is explicit about what’s not affected: Nexus 9000 fabric switches running in ACI mode, and the separate Nexus 3000 and 7000 product lines. Affected software spans NX-OS releases 10.3(1) through 10.6(3s), 45 releases in total, which is a wide enough range that “check the CVE list and move on” isn’t a substitute for actually running the Cisco Software Checker against your specific deployment.
Brand note: most vulnerability scanning treats a switch like any other inventory item, check the firmware version, flag the CVE, move on to the next asset. That misses the actual question, which is what an attacker can reach once they have root on the device that routes your traffic, not just whether the box is patched.
The XHack AI agent maps what a compromised network device can actually see and touch, the segments it bridges, the traffic it carries, the trust relationships built on top of it, before an attacker gets the chance to. For infrastructure that sits this close to the physical network layer, human-led VAPT validates that blast radius the way a real intrusion would, and XHack doesn’t store your findings on our servers either. Chats and session data stay local to you, and you can delete them whenever you want.
CVE-2026-20212 is a CVSS 9.8 unauthenticated remote code execution vulnerability affecting Silicon One ASIC-based Cisco Nexus 9000 switches. It stems from TCP ports 43210 and 43211 binding to an unrestricted IP address, allowing a remote attacker with no credentials to send crafted input that executes as root-privileged code on the device.
Ten Silicon One-based models: N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Nexus 9000 fabric switches running in ACI mode, along with the Nexus 3000 and 7000 lines, are not affected.
Cisco says it is not aware of any malicious use of the flaw as of its September 2, 2026 disclosure. It was found internally during a Technical Assistance Center support case rather than reported by an external researcher, and there’s no public proof-of-concept in circulation yet, but Cisco’s own guidance is that the gap between disclosure and exploitation has closed considerably in recent history.
Deploy an infrastructure ACL that blocks TCP traffic to ports 43210 and 43211 on locally configured device addresses, restricting reachability to trusted management and control-plane traffic only. Cisco also offers a temporary Live Protect shield for NX-OS 10.6(3) and 10.6(3s) Smart Switches, though it isn’t supported on the 9804/9808 chassis and shouldn’t replace patching.
Because a core switch sits at the center of the network fabric rather than at its edge. Root access on a Nexus 9000 gives an attacker a position to potentially intercept, redirect, or manipulate traffic across everything that switch carries, a much broader blast radius than compromising a single server, and one that’s harder for most security teams to detect because network infrastructure typically gets far less monitoring scrutiny than servers and endpoints.
CVE-2026-20212 is the kind of bug that reads simple on paper, an unrestricted IP binding, and lands as catastrophic in practice, unauthenticated root on core switching hardware. No confirmed exploitation yet is a head start, not a reason to deprioritize this. Check your Nexus 9000 fleet against the affected model list, run the Software Checker against your NX-OS version, and deploy the iACL workaround today if patching has to wait even a week. Core network infrastructure carries everything else you’re trying to protect, and it deserves the same urgency you’d give a compromised domain controller.
Related articles
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) Read this in 30 seconds: SonicWall confirmed activ...
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) Read this in 30 seconds: PaperCut RCE vulnerabilit...
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member) Read this in 30 seconds: CVE-2026-63077 is a [&hel...
