Full Report
Cisco has released patches to address a critical security flaw affecting 10 Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root, alongside an IOS XR hardening release bundling 7 umbrella CVEs, 2 of which are rated 9.8, with no workaround for any IOS XR version. The Nexus vulnerability, tracked as CVE-2026-20212 (CVSS score: 9.8), is
Analysis Summary
# Vulnerability: Cisco Nexus 9000 and IOS XR Critical Remote Code Execution
## CVE Details
- **CVE ID:** CVE-2026-20212 (Nexus 9000); CVE-2026-20274 & CVE-2026-20279 (IOS XR Umbrella CVEs)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-2112 (Binding to Unrestricted IP Address - Nexus); Memory-safety/Access-control (IOS XR)
## Affected Systems
- **Products:**
- Cisco Silicon One-based Nexus 9000 Series Switches
- Cisco IOS XR-based devices (including IOS XR7/LNT)
- **Versions:**
- **Nexus 9000:** NX-OS releases 10.3(1) through 10.6(3s).
- **IOS XR:** All versions (Check Software Checker for specific SMUs).
- **Configurations:**
- **Nexus 9000 PIDs:** N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808.
- Default Layer 3 virtual routing and forwarding (VRF) instance must be active.
## Vulnerability Description
**CVE-2026-20212:** The vulnerability stems from a service binding to an unrestricted IP address on TCP ports 43210 and 43211. An unauthenticated remote attacker can connect directly to these ports. By sending crafted input, the attacker can execute arbitrary code with **root privileges**. Additionally, exploitation can cause the S1HAL process to crash, leading to a full device reload (DoS).
**IOS XR Umbrella CVEs:** These represent bundles of vulnerabilities. CVE-2026-20274 covers memory-safety and resource-lifetime flaws, while CVE-2026-20279 covers missing authentication and improper certificate validation.
## Exploitation
- **Status:** Not exploited in the wild (as of September 2, 2026 disclosure).
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full system access)
- **Integrity:** High (Root-level execution)
- **Availability:** High (Potential for device reload/crash)
## Remediation
### Patches
- **Nexus 9000:** Upgrade to NX-OS 10.6(4) or higher.
- **IOS XR:** Apply Software Maintenance Updates (SMUs) specific to the release identified by the Cisco Software Checker.
### Workarounds
- **iACL:** Implement an infrastructure Access Control List to explicitly deny TCP traffic to the switch's IP addresses on ports 43210 and 43211.
- **Live Protect Shield:** Use shield `lp00031` for supported NX-OS 10.6(3) and 10.6(3s) devices (Note: unsupported on Nexus 9804/9808).
- **IOS XR:** There are **no workarounds** available; customers must upgrade/patch.
## Detection
- **Indicators of Compromise:** Monitor for unauthorized connections to TCP ports 43210 and 43211. Watch for unexpected reloads of the S1HAL process.
- **Detection Methods:** Use the `show module` command to verify if hardware PIDs match affected models. Use the [Cisco Software Checker](https://sec.cloudapps.cisco.com/security/center/softwarechecker.x) to verify vulnerable software versions.
## References
- Cisco Nexus 9000 Advisory: hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr
- Cisco Live Protect Documentation: hxxps://www[.]cisco[.]com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nxos-with-cisco-live-protect[.]html
- CVE Program Record: hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-20212