Cisco Patches Critical Nexus 9000 Flaw Enabling Remote Root Code Execution

Cisco has released security patches for a critical vulnerability affecting several Nexus 9000 switches that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. The networking giant has also issued a major IOS XR hardening release addressing seven CVEs, including two vulnerabilities rated CVSS 9.8.

The most serious issue, tracked as CVE-2026-20212, affects 10 Cisco Nexus 9000 models powered by Silicon One technology. The vulnerability carries a CVSS score of 9.8, making it a critical security risk for affected organizations.

According to Cisco, the flaw is caused by a service binding to unrestricted IP addresses. As a result, TCP ports 43210 and 43211 can remain accessible through the default Layer 3 VRF.

An attacker who can reach either port may be able to interact directly with the vulnerable service. By sending specially crafted input, the attacker could potentially execute malicious code with root-level privileges.

Successful exploitation could also crash the S1HAL process, potentially forcing the affected switch to reload.

Cisco Nexus 9000 Models Affected

Cisco has identified the following affected product IDs:

  • N9324C-SE1U
  • N9348Y2C6D-SE1U
  • N9364E-SG2-O
  • N9364E-SG2-Q
  • N9396T12C-SE1
  • N9348Y12C-SE1
  • N9396Y12C-SE1
  • N9336C-SE1
  • N9K-C9804
  • N9K-C9808

Other Nexus 9000 models, Nexus 9000 fabric switches operating in Application Centric Infrastructure (ACI) mode, and the Nexus 3000 and Nexus 7000 product families are not affected.

Cisco's advisory covers multiple affected NX-OS releases, with the CVE record listing versions ranging from 10.3(1) through 10.6(3s).

No Exploitation Reported Yet

Cisco said it was not aware of malicious exploitation of CVE-2026-20212 when the vulnerability was disclosed on September 2, 2026.

However, the company recommends customers use its Software Checker to determine the appropriate fixed release for their specific deployment.

Until a permanent update can be applied, Cisco has provided several mitigation options.

Organizations should:

  • Upgrade to the release recommended by Cisco's Software Checker.
  • Use an infrastructure access control list (iACL) to restrict unnecessary traffic.
  • Explicitly block TCP ports 43210 and 43211 where appropriate.
  • Deploy Cisco's Live Protect shield where supported.

The temporary Live Protect shield is available for specific NX-OS versions, while some Nexus models do not support the mitigation.

Cisco Releases IOS XR Hardening Update

Alongside the Nexus 9000 patch, Cisco released a major IOS XR hardening update covering seven CVEs.

Two vulnerabilities have a maximum CVSS score of 9.8:

  • CVE-2026-20274 - Memory-safety and resource-lifetime vulnerabilities
  • CVE-2026-20279 - Access-control vulnerabilities, including missing authentication for critical functions and improper certificate validation

The remaining five vulnerabilities, CVE-2026-20275 through CVE-2026-20278 and CVE-2026-20280, have maximum CVSS scores ranging from 8.2 to 8.8.

IOS XR Versions and SMUs

Cisco says the vulnerabilities affect IOS XR releases regardless of device configuration.

For XR7 platforms, including the Cisco 8000 Series, NCS 1010, NCS 540L and NCS 5700 Series, Cisco provides a dedicated Software Maintenance Update (SMU) that applies across releases.

SMUs are currently available for releases including:

  • IOS XR 6.9.2
  • IOS XR 7.3.2
  • IOS XR 7.9.2
  • IOS XR 7.9.21
  • IOS XR 7.10.2
  • IOS XR 7.11.2
  • IOS XR 7.11.21
  • IOS XR 24.2.2
  • IOS XR 24.2.21
  • IOS XR 24.4.2
  • IOS XR 25.2.21
  • IOS XR 25.4.1
  • IOS XR 25.4.2
  • IOS XR 26.1.2
  • IOS XR 26.2.1

Cisco also lists future SMUs for several additional releases. Customers running versions outside the supported table are advised to open a Technical Assistance Center (TAC) case.

Why These Cisco Vulnerabilities Matter

Network infrastructure is an attractive target because compromised routers and switches can provide attackers with visibility into internal traffic and connected systems.

The risk is particularly significant for organizations operating:

  • Data centers
  • Internet service provider networks
  • Enterprise infrastructure
  • Cloud environments
  • Telecommunications networks
  • Critical infrastructure

A vulnerability that provides unauthenticated remote code execution with root privileges can potentially allow an attacker to gain control of a network device without first obtaining valid credentials.

Cisco's New Vulnerability Disclosure Strategy

The latest IOS XR release is part of Cisco's newer approach to vulnerability disclosure, where multiple internally discovered vulnerabilities are grouped into umbrella CVEs based on Common Weakness Enumeration categories.

The September 2 release represents the third scheduled Cisco hardening release within 30 days, following earlier security updates for IOS XE, Catalyst SD-WAN, Crosswork and Secure Workload.

Additional Cisco Security Fixes

Cisco also addressed security issues in other products during the same release cycle.

Two S/MIME decryption vulnerabilities affecting Cisco Secure Email were assigned:

  • CVE-2026-20354
  • CVE-2026-20355

Both carry a CVSS score of 5.9 and could allow a machine-in-the-middle attacker to recover plaintext from certain S/MIME-protected email traffic.

Cisco additionally patched CVE-2026-20281, a denial-of-service vulnerability affecting several Cisco phone models when Web Access is enabled. The vulnerability carries a CVSS score of 7.5.

Fire Ant Activity Highlights Router Security Risks

The Cisco patches arrive shortly after cybersecurity company Sygnia reported activity linked to the China-nexus threat actor known as Fire Ant.

The investigation found suspicious implants on IOS XR routers that could suppress syslog traffic, hide command output and establish a covert GRE tunnel.

The actor was also observed capturing network packets, transferring them to external FTP servers and performing network reconnaissance against connected infrastructure.

What Organizations Should Do

Security teams running affected Cisco infrastructure should prioritize the following actions:

  1. Identify affected devices using Cisco's Software Checker.
  2. Check whether CVE-2026-20212 applies to deployed Nexus 9000 hardware.
  3. Upgrade to a fixed NX-OS release as soon as possible.
  4. Restrict TCP ports 43210 and 43211 if immediate patching is not possible.
  5. Apply the recommended IOS XR SMUs where available.
  6. Review router logs and configuration changes for signs of unauthorized activity.
  7. Investigate unexplained tunnels, modified configurations or unusual outbound connections.
  8. Monitor network infrastructure closely for exploitation attempts.

Bottom Line

Cisco's latest security release addresses a critical Nexus 9000 vulnerability that could enable unauthenticated remote code execution as root, along with seven IOS XR vulnerabilities including two rated CVSS 9.8.

Although Cisco has not reported active exploitation of the Nexus flaw, the combination of remote attackability, no authentication requirement and root-level code execution makes CVE-2026-20212 a high-priority vulnerability for organizations operating affected Nexus 9000 switches.

Security teams should identify vulnerable devices, apply Cisco's recommended fixes and restrict exposed management and service ports without delay.