CVE-2026-20212Patch

HIGHCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 18 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Back to dashboard

6.3/ 10 priority

Sources & remediation

Other references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

Weakness type (CWE)

CWE-1327

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
57 mentions across 12 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 39 signals
Technical details provided in 56 signals
Disclosure: 23 classified signals
Peaked 9d ago at 18 mentions (2026-09-04); latest day: 1
57 total mentions across 12 days

Deep dive

Activity timeline57 mentions / 12d

Signal classification4 categories

Patch

3256.1%

Disclosure

2340.4%

Active Exploitation

11.8%

General

11.8%

Referenced assets38 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-02	1	Disclosure1
2026-09-03	17	Active Exploitation1Disclosure9Patch7
2026-09-04	18	Disclosure6General1Patch11
2026-09-05	3	Disclosure1Patch2
2026-09-06	4	Patch4
2026-09-07	3	Disclosure1Patch2
2026-09-08	3	Disclosure1Patch2
2026-09-09	1	Patch1
2026-09-10	3	Disclosure1Patch2
2026-09-11	2	Disclosure2
2026-09-12	1	Disclosure1
2026-10-01	1	Patch1

Full discourse20 posts

The Hacker News@TheHackersNews45d
Disclosure
🚨 A critical Cisco Nexus 9000 flaw lets unauthenticated remote attackers run code as root. CVE-2026-20212 leaves TCP ports 43210 and 43211 reachable in the default Layer 3 VRF on 10 switch models. Affected models, fixes, and mitigations: https://thehackernews.com/2026/09/critical-cisco-nexus-9000-flaw-lets.html
Post summary
A critical Cisco Nexus 9000 vulnerability (CVE-2026-20212) allowing unauthenticated remote code execution via open TCP ports 43210/43211 has been disclosed, with linked fixes and mitigations provided.
57111863651.9K
2.4M followersView on X
Sekurak@Sekurak40d
Patch
🚨 Krytyczna luka w popularnych przełącznikach Nexus serii 9000 od Cisco [CVE-2026-20212] 💻 Dotyczy modeli z układami Silicon One. 👤 Podatność umożliwia wykonanie kodu z uprawnieniami roota. Nie jest wymagane uwierzytelnienie. 🛠️ Powodem całego zamieszania jest udostępnienie usługi sieciowej na portach TCP 43210 i 43211 w domyślnej instalacji L3 VRF. 🛡️ Producent wypuścił aktualizacje oraz dał wytyczne dotyczące tymczasowych środków zaradczych. 👉 Szczegóły: https://sekurak.pl/krytyczna-luka-w-przelacznikach-cisco-nexus-9000-cve-2026-20212-rce-bez-uwierzytelnienia-i-dostep-do-roota/
Post summary
The article announces CVE‑2026‑20212 in Cisco Nexus 9000 switches, provides technical details of a privileges‑escalation flaw, and notes that Cisco has issued patches and temporary mitigations.
1204024.2K
45.1K followersView on X
The CyberSec Guru@thecybersecguru45d
Patch
🚨 CRITICAL CISCO SECURITY ALERT 🚨 CVE-2026-20212 is a CVSS 9.8 unauthenticated RCE affecting Silicon One-based Cisco Nexus 9000 switches. 🔴 Remote code execution as ROOT 🔴 No authentication required 🔴 TCP ports 43210/43211 exposed 🔴 S1HAL crash can force device reload 🔴 10 Nexus 9000 models affected Cisco has released fixes and a temporary mitigation. Full technical breakdown + affected models + remediation 👇 https://thecybersecguru.com/news/cve-2026-20212-cisco-nexus-9000-rce/ #CVE202620212 #CVE #Cisco #CiscoNexus #Nexus9000 #RCE #CyberSecurity #InfoSec #NetworkSecurity #CybersecurityNews
Post summary
The post announces a critical RCE vulnerability in Cisco Nexus 9000 switches, details technical aspects, and notes that Cisco has released fixes and a temporary mitigation.
020138919
1.6K followersView on X
ThreatWire@ThreatWire_45d
Patch
🚨 CRITICAL: CVE-2026-20212 (CVSS 9.8) is a critical Cisco Nexus 9000 vulnerability that allows unauthenticated remote attackers to execute code with root privileges. The flaw affects Nexus 9000 switches using Silicon One ASICs. TCP ports 43210 and 43211 are exposed in the default Layer 3 VRF, allowing attackers to send crafted input that can be executed as root. ⚠️ Cisco has released software updates and a temporary Live Protect Shield. Administrators should patch affected switches immediately or apply the recommended iACL mitigation. 🔗 http://cisco.com/security/advisories/… #Cisco #Nexus9000 #CVE #RCE #NetworkSecurity #CyberSecurity #Infosec
Post summary
The advisory announces CVE-2026‑20212, a critical root‑level code execution flaw in Cisco Nexus 9000 switches, and urges immediate patching or the use of Live Protect Shield and iACL mitigations to prevent exploitation.
0401441.0K
1.7K followersView on X
Rıdvan Yağlı@ridvanyagli45d
Disclosure
🔴 Cisco Nexus 9000'larda kritik RCE açığı: CVSS 9.8 Cisco Nexus 9000 serisinin Silicon One ASIC kullanan bazı modellerinde, kimlik doğrulaması gerektirmeden root yetkisiyle uzaktan kod çalıştırılmasına izin veren kritik bir açık (CVE-2026-20212) ortaya çıktı. Açığın dikkat çeken noktası, varsayılan L3 VRF içerisinde erişilebilir olan TCP 43210 ve 43211 portları. Saldırgan bu portlara erişebiliyorsa özel hazırlanmış girdiler göndererek kod çalıştırabiliyor. İstismar ayrıca S1HAL sürecinin çökmesine ve cihazın yeniden yüklenmesine neden olabiliyor. Cisco şu anda kötüye kullanım tespit etmediğini belirtiyor ancak etkilenen sistemlerin acilen güncellenmesini öneriyor. Güncelleme yapılamıyorsa TCP 43210/43211 için iACL uygulanması ve uygun sistemlerde Live Protect Shield kullanılması öneriliyor. Önemli: Tüm Nexus 9000 modelleri etkilenmiyor. Etki, Silicon One kullanan belirli modeller ve NX-OS sürümleriyle sınırlı. https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-n9k-s1-rce-EH8dEtr.html
Post summary
Cisco issued a disclosure on CVE-2026-20212, a critical RCE affecting certain Nexus 9000 models that use Silicon One ASIC, and provided detailed vulnerability info along with patch and mitigation recommendations.
0201171.1K
2.4K followersView on X
Aircorridor@_aircorridor39d
Disclosure
Remote Code Execution Vulnerability in Cisco Nexus 9000 Series Switches | CVE-2026-20212 https://www.esecurityplanet.com/news/news-cisco-nexus-9000-vulnerability/ https://t.co/iKrlyMVQ1c
Post summary
The text announces that Cisco Nexus 9000 series switches are vulnerable to CVE‑2026‑20212, a remote code execution flaw, with a news article providing further details.
01063552
14.9K followersView on X
GovCERT.CZ@GOVCERT_CZ45d
Disclosure
🚨 Upozorňujeme na kritické zranitelnosti v Cisco Nexus 9000 Series Switches a Cisco IOS XR Software, CVE-2026-20212, CVE-2026-20274 a CVE-2026-20279. Zranitelnost CVE-2026-20212 umožňuje neautentizovanému vzdálenému útočníkovi spustit libovolný kód s oprávněními root na switchích Cisco Nexus 9000. Zranitelnost CVE-2026-20274 zahrnuje chyby správy prostředků v Cisco IOS XR, které mohou způsobit poškození paměti, přetečení vyrovnávací paměti, přístup mimo její hranice nebo stav use-after-free. Zranitelnost CVE-2026-20279 je způsobena nesprávným řízením přístupu v Cisco IOS XR a může vést k neoprávněnému přístupu k chráněným funkcím. Úspěšné zneužití může mít za následek spuštění libovolného kódu, kompromitaci zařízení, neoprávněný přístup nebo narušení dostupnosti služeb. Dotčeny jsou příslušné verze switchů Cisco Nexus 9000 a softwaru Cisco IOS XR včetně Cisco IOS XR7 (LNT). 📌Doporučujeme aktualizovat na nejnovější verzi.
Post summary
The post announces critical CVEs for Cisco Nexus 9000 and IOS XR, outlines technical details of each vulnerability, and urges users to update to the latest software version.
01071912
4.3K followersView on X
DrMashari@GMashari43d
Patch
📌 ثغرة تنفيذية عن بعد في سلسلة مفاتيح Cisco Nexus 9000 تسمح بتنفيذ تعليمات برمجية ضارة 🛡️ الفئة: ثغرة 📝 الملخص: تم إصلاح ثغرة أمنية حرجة في سلسلة مفاتيح Cisco Nexus 9000 تسمح بتنفيذ تعليمات برمجية ضارة عن بعد بدون الحاجة إلى مصادقة. تم تعقب هذه الثغرة الأمنية CVE-2026-20212 ولها درجة خطورة CVSS تبلغ 9.8. يمكن للمهاجم عن بعد غير المصادق استغلال هذه الثغرة لتنفيذ تعليمات برمجية ضارة بامتيازات الجذر. أصدرت Cisco تصحيحات لهذه الثغرة في 10 مفاتيح من سلسلة Nexus 9000 المستندة على Silicon One. — يُنصح بتطبيق التصحيحات الأمنية على الفور. 🗓️ تاريخ النشر: 03/09/2026 🔗 للمزيد: https://securityaffairs.com/?p=198366
Post summary
The post announces the discovery of a critical remote code‑execution vulnerability in Cisco Nexus 9000 switches and highlights that Cisco has released patches for all affected devices.
01030360
8.7K followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Disclosure
CVE-2026-20212, a critical Cisco Nexus 9000 vulnerability, lets an unauthenticated attacker gain remote code execution with root privileges. CVSS 9.8. #Cisco #Nexus9000 #SiliconOne #RCE #NXOS #NetworkSecurity #InfoSec #PatchNow https://securityonline.info/cisco-nexus-9000-cve-2026-20212-rce/
Post summary
The text announces a critical RCE vulnerability in Cisco Nexus 9000 with a CVSS of 9.8, providing only basic technical details and a link to further information.
01021482
13.0K followersView on X
SOCRadar®@socradar44d
Patch
🚨 Critical vulnerability alert — 2 CVEs, both CVSS 9.8 CVE-2026-20212 (Cisco Nexus 9000) → Unauthenticated root-level RCE → Hits Nexus 9000 w/ Silicon One, via TCP 43210/43211 → Can crash S1HAL & reload switch CVE-2026-73749 (HPE ArubaOS-CX) → Unauthenticated RCE w/ elevated privileges → Triggered by crafted network packets → Hits multiple AOS-CX branches No known active exploitation on either, patch now. Learn more:https://hubs.la/Q04wKV8F0 #Cisco #HPE #RCE #CyberSecurity
Post summary
The tweet alerts users to two new high‑CVSS critical vulnerabilities (unauthenticated root‑level RCE in Cisco Nexus 9000 and elevated‑privilege RCE in HPE ArubaOS‑CX) and explicitly urges immediate patching.
00030915
7.1K followersView on X
DC3 DCISE@DC3DCISE18d
Patch
#DCISEWarning: Critical #Cisco Switch Flaw Threat: CVE-2026-20212 lets unauthenticated attackers run code and gain full root control of Nexus 9000 switches. Action: Apply recommended software updates immediately! #PatchNow https://t.co/AvaK5GuOPi
Post summary
The tweet warns of a critical Cisco Nexus 9000 flaw (CVE-2026-20212) that allows unauthenticated code execution and root access, and urges immediate software updates to mitigate the risk.
10010122
743 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker38d
Disclosure
【重要】Cisco Nexus 9000の一部機種にCVSS 9.8、更新を https://www.cybernote.click/2026/09/03/cisco-nexus-9000-cve-2026-20212-silicon-one-root-rce/ #IT #Security #cybersecurity
Post summary
The post announces a high‑severity CVE‑2026‑20212 affecting certain Cisco Nexus 9000 models, notes that an update/patch is required, and indicates a root‑level remote code execution flaw.
0001170
204 followersView on X
Aspida@aspidaHQ43d
Patch
CVE-2026-20212 (CVSS 9.8): unauthenticated attackers can get root RCE on Cisco Nexus 9000 switches, no interaction needed. Cisco also dropped an IOS XR hardening bundle with two more 9.8 flaws, no workaround. Update firmware and migrate IOS XR now. #NetworkSecurity #Cisco https://t.co/BLxVlp58GZ
Post summary
CVE‑2026‑20212 allows unauthenticated attackers to achieve root RCE on Cisco Nexus 9000 switches; Cisco has released a hardening bundle and urges firmware upgrades and IOS XR migration to mitigate this high‑severity flaw.
00110174
9 followersView on X
Red Secure Tech Ltd.@redsecuretech45d
Disclosure
CISCO ALERT: Critical RCE Vulnerability CVE-2026-20212 affects 10 Nexus 9000 switches. Unauthenticated attackers can execute code as root. Read more: https://www.redsecuretech.co.uk/blog/post/cisco-nexus-cve-2026-20212-critical-rce-vulnerability/1463 #Cisco #Nexus9000 #CVE202620212 #RCE #IOSXR #NetworkSecurity #CyberSecurity #InfoSec https://t.co/7I4oDoGW0l
Post summary
Cisco alerts to CVE-2026-20212, a critical RCE affecting Nexus 9000 switches that allows unauthenticated attackers to run code as root.
0101052
81 followersView on X
Abdullah Alshehri@vm_3245d
Disclosure
ثغرة حرجة بتقييم CVSS 9.8 تضرب بعض أجهزة Cisco Nexus 9000 وتسمح لمهاجم غير موثّق بتنفيذ أوامر بصلاحيات root. المشكلة مرتبطة بمنفذي TCP/43210 وTCP/43211، لكن القصة أكبر من مجرد منفذين مفتوحين. في المقال الجديد أشرح: • كيف تعمل CVE-2026-20212 تقنيًا • الأجهزة والإصدارات المتأثرة • خيارات iACL وLive Protect • ما الذي يحدث مع تحديثات IOS XR وSMU التفاصيل الكاملة في المدونة https://vm32.com/articles/0f48dfc9-27ae-4c40-870b-575c538cfa4d
Post summary
The blog post discloses details of CVE‑2026‑20212 affecting Cisco Nexus 9000, providing technical explanation but offering no proof of concept, exploit code, or evidence of active exploitation.
00011351
32 followersView on X
ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker36d
Disclosure
【重要】Cisco Nexus 9000の一部機種にCVSS 9.8、更新を https://www.cybernote.click/2026/09/03/cisco-nexus-9000-cve-2026-20212-silicon-one-root-rce/ #IT #Security #cybersecurity
Post summary
The post announces a new high‑severity CVE (CVSS 9.8) affecting certain Cisco Nexus 9000 models, without providing PoC, exploit, or mitigation details.
0000190
204 followersView on X
INFOSEC.WATCH@InfosecDotWatch38d
Patch
Cisco CVE-2026-20212 can allow unauthenticated remote root code execution on affected Nexus 9000 Silicon One switches through TCP 43210/43211. Updates and a workaround are available; Cisco says it has not seen malicious use.
Post summary
Cisco has disclosed CVE-2026-20212, detailing unauthenticated remote root code execution on Nexus 9000 switches via ports 43210/43211, and notes that updates and a workaround are available while no malicious use has been observed.
1000042
39 followersView on X
NCIIPC India@NCIIPC41d
Disclosure
A #Critical #RCE Vulnerability has been discovered in #CISCO Nexus 9000 Series Switches. #CVE-2026-20212 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr
Post summary
A new critical remote code execution vulnerability has been announced for Cisco Nexus 9000 Series Switches (CVE-2026-20212), with a Cisco Security Advisory linked for details.
00010284
8.5K followersView on X
ねこさん⚡(ΦωΦ)@catnap70742d
Patch
「Cisco Nexus 9000」に深刻なRCE脆弱性 - 修正版を提供：Security NEXT https://www.security-next.com/189869 "脆弱性「CVE-2026-20212」…TCP 43210番ポートと43211番ポートへアクセスできることに起因。認証を必要とせず、リモートより細工した入力を送信することで、root権限でコードを実行することが可能に"
Post summary
The advisory announces a critical RCE vulnerability in Cisco Nexus 9000 (CVE‑2026‑20212) on ports 43210/43211 with no authentication required, and provides a patch to mitigate the issue.
00001205
3.5K followersView on X
كاسبر سكاي@KasperskyDev43d
Patch
⚠️ ثغرة حرجة في سيسكو نيكسس 9000 تتيح تنفيذ كود بصلاحيات الجذر بلا مصادقة. المعرف : CVE-2026-20212 درجة الخطورة : 9.8 (CVSS) - Critical الإصدارات المتأثرة : Cisco Nexus 9000 (Silicon One) الحل : Block TCP 43210/43211; upgrade NX-OS #Cisco #CVE202620212
Post summary
A critical vulnerability (CVE‑2026‑20212) in Cisco Nexus 9000 enables unauthenticated root code execution; the advisory recommends blocking TCP ports 43210/43211 and upgrading NX‑OS.
01000298
39.9K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-20212

Sekurak[verified]@SekurakPatch

The article announces CVE‑2026‑20212 in Cisco Nexus 9000 switches, provides technical details of a privileges‑escalation flaw, and notes that Cisco has issued patches and temporary mitigations.

The CyberSec Guru[verified]@thecybersecguruPatch

The post announces a critical RCE vulnerability in Cisco Nexus 9000 switches, details technical aspects, and notes that Cisco has released fixes and a temporary mitigation.

ThreatWire[verified]@ThreatWire_Patch

The advisory announces CVE-2026‑20212, a critical root‑level code execution flaw in Cisco Nexus 9000 switches, and urges immediate patching or the use of Live Protect Shield and iACL mitigations to prevent exploitation.

Rıdvan Yağlı[verified]@ridvanyagliDisclosure

Cisco issued a disclosure on CVE-2026-20212, a critical RCE affecting certain Nexus 9000 models that use Silicon One ASIC, and provided detailed vulnerability info along with patch and mitigation recommendations.

GovCERT.CZ[verified]@GOVCERT_CZDisclosure

The post announces critical CVEs for Cisco Nexus 9000 and IOS XR, outlines technical details of each vulnerability, and urges users to update to the latest software version.

SOCRadar®[verified]@socradarPatch

The tweet alerts users to two new high‑CVSS critical vulnerabilities (unauthenticated root‑level RCE in Cisco Nexus 9000 and elevated‑privilege RCE in HPE ArubaOS‑CX) and explicitly urges immediate patching.

Abdullah Alshehri[verified]@vm_32Disclosure

The blog post discloses details of CVE‑2026‑20212 affecting Cisco Nexus 9000, providing technical explanation but offering no proof of concept, exploit code, or evidence of active exploitation.

INFOSEC.WATCH[verified]@InfosecDotWatchPatch

Cisco has disclosed CVE-2026-20212, detailing unauthenticated remote root code execution on Nexus 9000 switches via ports 43210/43211, and notes that updates and a workaround are available while no malicious use has been observed.