A single unauthenticated packet to the right TCP port can hand an attacker root on some of Cisco’s biggest data-center switches. That is the shape of CVE-2026-20212, a flaw rated 9.8 on the CVSS scale that affects Silicon One-based models in the Cisco Nexus 9000 series. There is no user, no password, and no clever multi-step chain. The service is simply listening where it should not be.
What happened
Cisco disclosed a critical vulnerability in NX-OS running on Nexus 9000 switches built on its Silicon One chipset. Affected hardware includes models such as the N9K-C9804, N9K-C9808, N9324C-SE1U and N9336C-SE1, among others. The scope is specific: other Nexus 9000 platforms, switches running in ACI mode, and the Nexus 3000 and 7000 families are not affected.
The bug spans a wide band of software. Releases from NX-OS 10.3(1) through 10.6(3s) are vulnerable, which works out to 45 individual releases. As of 2 September 2026, Cisco reported no evidence of exploitation in the wild. That is reassuring for exactly as long as it lasts, since a 9.8 with no authentication and root-level impact is the kind of target that attracts attention fast.
How it works
The root cause is a service that binds to an unrestricted IP address instead of a loopback or a locked-down management interface. That mistake leaves TCP ports 43210 and 43211 open in the default Layer 3 VRF, which is the routing context most likely to carry production and reachable traffic. Anyone who can route packets to the switch’s address on those ports can talk directly to the service.
Cisco’s own description is blunt: “An attacker who can reach a switch’s address on either port can connect directly to the service. Crafted input sent to that service is then executed as code with root privileges.” No credentials are checked because the exposure sits below the authentication layer entirely. The listener trusts whoever connects.
Vulnerable ports (default L3 VRF):
TCP/43210
TCP/43211
Affected software: NX-OS 10.3(1) .. 10.6(3s) (45 releases)Two details make this worse than a typical service bug. First, it lives in the default VRF, so in many networks the port is reachable from far more of the estate than an operator would assume. Second, the payoff is immediate code execution as root, which on a core switch means traffic capture, redirection, and a foothold that survives most host-level defenses because the host is the network fabric.
Why it matters
Core switches are supposed to be the quiet part of the room. They rarely get patched on a fast cadence, they often sit for years, and their management surfaces are frequently trusted by default because “it’s internal.” This flaw punctures that assumption. A switch that answers on 43210 or 43211 from an internal segment, a lab VLAN, or a poorly filtered inter-site link is one bad packet away from full compromise.
For organisations in Cyprus running Nexus 9000 gear in banks, telecoms, shipping, and hosting environments, the practical risk is segmentation that looks tighter on a diagram than it is on the wire. Flat internal networks and permissive east-west paths turn a “not exploited yet” advisory into a countdown. The device inventory question is simple to state and awkward to answer: which of our switches are Silicon One models, on which NX-OS release, and who can currently reach those two ports?
What to do
Cisco has published fixed software, and the priority is to patch. Use the Cisco Software Checker to confirm whether your exact release and platform are affected and to identify the target fixed version. Alongside the upgrade, layer these controls:
- Deploy an infrastructure ACL (iACL) that blocks inbound TCP 43210 and 43211 to switch management and interface addresses, permitting only what genuinely needs to reach the control plane.
- Where you cannot patch immediately, evaluate the Live Protect shield lp00031 as a temporary mitigation. Note its limits: it applies only to NX-OS 10.6(3) and 10.6(3s), and it is not supported on the 9804 and 9808 chassis.
- Confirm the default VRF is not carrying reachability you never intended, and treat management planes as assets that need their own isolation rather than a shared broadcast domain.
Patching one CVE does not tell you what else on the fabric answers to an unauthenticated stranger. That is where testing earns its keep. A combination of external and internal network and infrastructure penetration testing is how you find reachable admin services, exposed control-plane ports, and the segmentation gaps that let a single vulnerable switch become an estate-wide problem. We map what is actually reachable from each segment, not what the design document claims.
Bottom line
CVE-2026-20212 is a clean, high-impact reminder that the scariest exposures are often boring misconfigurations: a service bound to the wrong address, two open ports, and root at the end of the line. Patch the affected Nexus 9000 switches, filter 43210 and 43211, and verify your segmentation with real testing before someone else tests it for you. For the full disclosure, see the write-up at The Hacker News.