A CVSS 9.8 flaw opens a remote root shell on ten Cisco Nexus 9000 switches
On 2 September 2026 Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that leaves TCP ports 43210 and 43211 on ten Nexus 9000 switches reachable for unauthenticated remote code execution as root. Apply an iACL on both ports and the Live Protect lp00031 shield now, then check your release in the Software Checker.
2 September 2026. Cisco discloses CVE-2026-20212, a CVSS 9.8 vulnerability affecting ten Silicon One-based Nexus 9000 switches. TCP ports 43210 and 43211. An unauthenticated attacker who can reach either port executes code as root on the switch. Why it matters: the ports are reachable by default in the Layer 3 VRF, and Cisco has published no fixed-release table — the immediate fix is an iACL, a temporary shield, and the Software Checker.
Two ports open by default in the Layer 3 VRF
The root cause fits in one sentence: the vulnerable service binds to an unrestricted IP address. As a result, TCP ports 43210 and 43211 remain reachable in the switch’s default Layer 3 VRF. An attacker who can reach the device on either port connects directly to the service, and crafted input is then executed with root privileges.
The impact is two-fold. Beyond code execution, an exploitation attempt can also crash the S1HAL process and reload the device — so even a miscalibrated exploit turns into a denial of service on a production data plane. Cisco says it is unaware of any malicious use as of the 2 September disclosure.
The affected product list is precise, and verifiable with the show module command: the Nexus Smart Switches N9324C-SE1U and N9348Y2C6D-SE1U, the N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1 and N9336C-SE1 boxes, and the N9K-C9804 and N9K-C9808 chassis. Other Nexus 9000 models, fabrics running in ACI mode, and the Nexus 3000 and 7000 lines are unaffected.
The software footprint is broad. The Hacker News confirmed on 3 September through the CVE Program record that Cisco lists 45 NX-OS releases, from 10.3(1) through 10.6(3s), as affected — a range the advisory itself defers to the Software Checker.
How to tell whether you are exposed
The first reflex is to identify the affected devices. The show module command returns the PID of each card, which you can cross-reference against the ten affected identifiers — the Smart Switches, the N9364E/N9396 boxes, and the 9804/9808 chassis.
The second question is the uncomfortable one: are your ports 43210 and 43211 reachable? They are open by default in the Layer 3 VRF, which means a properly segmented management plane may not be enough. If traffic to the switch’s address on those ports is not filtered upstream, the device is exposed to anything that routes to it — including, in poorly segmented deployments, guest networks or third-party subnets.
The check is simple and worth scripting: a targeted scan of the two ports on every affected switch, or a review of your border ACLs. Better a false positive than a production switch answering on a port you believed was closed.
No release table: an iACL and a shield in the meantime
What makes the response awkward is this: Cisco has published no fixed-release table. Network teams must check their release in the Software Checker and, until then, apply the two documented mitigations.
The first is an iACL (infrastructure access control list) that permits only management and control-plane traffic, or explicitly denies TCP packets to ports 43210 and 43211. Cisco is explicit that the rule must be proven in a test environment first — a badly written iACL on a datacenter switch’s control plane cuts remote management entirely.
# Minimal iACL to validate in a lab first: allow established sessions,
# then deny the two vulnerable ports.
ip access-list extended BLOCK-VULN-PORTS
permit tcp any any established
deny tcp any any eq 43210
deny tcp any any eq 43211The second is the Live Protect shield lp00031, a temporary workaround. It is supported only on NX-OS 10.6(3), and — via a second package — on 10.6(3s) for the two Smart Switches, but not on the Nexus 9804 and 9808. Deploying it requires SSH, Telnet or NX-API access. Notably, upgrading to NX-OS 10.6(4) or later transitions the shield to N/A — a signal that a definitive fix is expected in those trains.
The same day, an IOS XR hardening release capped at two 9.8s
The 2 September drop does not stop at the Nexus 9000. Cisco shipped a parallel IOS XR hardening release bundling seven umbrella CVEs, including two at the 9.8 ceiling.
The disclosure model is now explicit: each CWE bucket gets a single CVE, scored at the most severe defect in that bucket. CVE-2026-20274 covers memory-safety and resource-lifetime bugs; CVE-2026-20279 covers access control, including missing authentication for critical functions and improper certificate validation. The other five top out between 8.2 and 8.8. The flaws affect all releases, regardless of configuration.
Remediation runs through SMUs (software maintenance updates) rather than full upgrades. Cisco mentions “approximately 16 SMUs per release” and says 26.2.2 and 26.3.1 will be the first fixed releases needing none. The XR7 (LNT) platforms — Cisco 8000, NCS 1010, NCS 540L, NCS 5700 — have a dedicated SMU. Of the 111 IOS XR releases listed as affected, 14 have a SMU available today, 4 are waiting, and 93 must be upgraded before a fix can be applied.
The context makes this drop heavier to carry. Six days earlier, Sygnia documented Fire Ant, a China-linked actor running purpose-built implants on IOS XR routers: suppressed syslog delivery, filtered show output, and a hidden GRE tunnel for exfiltration. The investigation began with a single detail — an active tunnel interface with no running configuration or commit history to explain it.
The same publication day carried two smaller advisories worth knowing, without urgency. Cisco fixed a pair of S/MIME decryption flaws in Secure Email — CVE-2026-20354 and CVE-2026-20355 (CVSS 5.9) — that let a machine-in-the-middle attacker recover plaintext between gateways running AsyncOS 16.5.0 or earlier. A third advisory fixes a phone denial-of-service bug, CVE-2026-20281 (CVSS 7.5), on Desk Phone 9800, IP Phone 7800/8800 and Video Phone 8875 registered to Unified Communications Manager with web access enabled — off by default. Both reminders confirm that Cisco’s twice-monthly cadence now produces volumes that teams must triage by real priority, not arrival order.
Verdict
If you run Silicon One Nexus 9000s — Smart Switch, 9804 or 9808 — apply the iACL on ports 43210/43211 now, deploy shield lp00031 where supported, and check your NX-OS train in the Software Checker. The risk is real: unauthenticated root RCE on a datacenter switch’s control plane is a pivot into the entire network.
If you are on IOS XR, the work is more tedious: inventory your releases, cross-reference the available SMUs, and prioritize CVE-2026-20274 and CVE-2026-20279 (9.8) over the other five. Do not wait for a fixed release where a SMU already exists.
In both cases, treat the management plane as an attack surface in its own right: the Fire Ant case is a reminder that a router whose operational state no longer matches its configuration can no longer be trusted on audit.