CISCO has patched a critical remote code execution flaw in the Nexus 9000 series switches that use Silicon One hardware. The vulnerability, tracked as CVE-2026-20212, allows an unauthenticated attacker to run code with root privileges, with a CVSS score of 9.8. Cisco’s advisory notes the issue stems from exposure of TCP ports 43210 and 43211 in the default Layer 3 VRF; a remote client can send crafted data that is executed with root privileges and may cause the S1HAL process to crash, potentially forcing a reload. The flaw was identified by Cisco’s Technical Assistance Centre during investigations of a customer case.
According to the advisory, the affected devices are 10 Nexus 9000 switches built on Silicon One ASICs. The models listed include N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Administrators can verify inclusion via the output of the show module command, which reveals the PID of the switch (for example, N9336C-SE1). The advisory clarifies that other Nexus 9000 models, Nexus 9000s in ACI mode, and the Nexus 3000/7000 series are not affected.
Cisco has offered mitigations: use iACLs to limit management and control traffic to affected devices, or block TCP traffic to the IPs on ports 43210 and 43211. A Live Protect shield is available for temporary protection while upgrading to a fixed NX-OS release, which Cisco recommends as the permanent fix after testing in the organisation’s environment. Cisco PSIRT states there is no known public disclosure or active exploitation at the time of the advisory, issued on 3 September 2026.