Cisco Patches Critical RCE in Nexus 9000 Switches

Cisco patched CVE-2026-20212, a critical flaw in the Silicon One integration for certain Nexus 9000 Series switches. The Cisco advisory, published September 2, rates it CVSS 9.8. An unauthenticated remote attacker may be able to execute code with root privileges or crash the S1HAL process and reload the device.

The exposure is limited to Nexus 9000 models that include a Silicon One ASIC. Cisco’s listed product IDs are N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Other Nexus 9000 models and Nexus 9000 switches running in ACI mode are not listed as vulnerable. Check the product ID with show module, then use Cisco’s advisory or Software Checker to identify the fixed NX-OS release for that device.

Cisco does provide a workaround while an upgrade is being scheduled. The advisory recommends infrastructure access control lists that allow only required management and control-plane traffic to the affected device. It also describes blocking TCP traffic destined for the device on ports 43210 and 43211. Cisco says this mitigation was tested, but operators should validate it against their own network because access-control changes can affect device functionality. Cisco also lists a temporary Live Protect shield.

Cisco had not reported exploitation in the cited advisory. Treat that as the status at publication, not proof that the flaw has never been exploited. Patch planning should still use the affected product ID and fixed release rather than assuming every Nexus 9000 switch is in scope.