# Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Execute Code as Root


## The Threat


A critical remote code execution vulnerability in Cisco's Nexus 9000 series switches — specifically those built on Silicon One ASICs — allows an unauthenticated attacker to execute arbitrary commands as root over the network. No credentials required. No local access needed. CVE-2026-20212 sits at a CVSS 9.8, and for once that score isn't inflated: these switches are the spine of enterprise data centers and large-scale cloud fabrics, and compromising them means owning the network at its most fundamental layer.


The flaw stems from insufficient input validation in a service exposed on the management plane of affected Nexus 9000 Silicon One-based platforms. By sending a crafted request to that service, an attacker can achieve root-level code execution on the switch OS — the kind of access that lets you manipulate routing tables, clone traffic, pivot laterally, or simply brick the device. Because the attack requires no authentication, it's exploitable by any adversary with network reachability to the management interface, which in misconfigured environments can include the data plane itself.


Cisco released this patch alongside a separate IOS XR hardening bulletin that bundles seven CVEs under a single umbrella advisory, two of which also score 9.8. Critically, Cisco has confirmed there are no workarounds available for any IOS XR version — meaning organizations running IOS XR in any capacity are patch-or-expose, full stop. The combined disclosure represents one of Cisco's more consequential security drops in recent memory, targeting infrastructure that underpins carrier networks, hyperscalers, and enterprise backbone deployments simultaneously.


## Severity and Impact


| CVE | CVSS Score | Vector String | Attack Complexity | Authentication Required | CWE |

|-----|-----------|---------------|-------------------|------------------------|-----|

| CVE-2026-20212 | 9.8 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | CWE-20 (Improper Input Validation) |

| IOS XR CVE #1 (umbrella) | 9.8 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | TBD per sub-CVE |

| IOS XR CVE #2 (umbrella) | 9.8 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Low | None | TBD per sub-CVE |

| IOS XR CVEs #3–7 (umbrella) | Varies | — | — | — | TBD per sub-CVE |


The Nexus CVE's attack vector is network-adjacent at minimum, and potentially fully remote depending on whether the management interface is exposed. The confidentiality, integrity, and availability impact scores are all rated High — which is accurate given that root execution on a core switch is effectively total compromise of that device and everything it routes.


## Affected Products


Nexus 9000 Series (Silicon One-based platforms)

  • Nexus 9000 switches running in standalone NX-OS mode (Silicon One ASIC variants)
  • Cisco has identified 10 specific platform SKUs as affected — consult the full Cisco Security Advisory for the hardware model list, as not all Nexus 9000 variants use Silicon One

    • IOS XR (all versions, no exceptions)

  • Cisco IOS XR Software across all supported release trains
  • Both physical and virtual (XRv/XRv 9000) deployments are in scope
  • No version of IOS XR is exempt from the umbrella advisory; Cisco has explicitly stated no workaround exists for any IOS XR release

    • > Note: Nexus 9000 switches running in ACI (Application Centric Infrastructure) mode have a different attack surface — verify your deployment mode before assuming exposure.


    ## Mitigations


    For Nexus 9000 (CVE-2026-20212):


  • Patch immediately. Cisco has released fixed NX-OS software versions. This is a CVSS 9.8 with no authentication requirement — there is no risk calculus that justifies deferring this patch.
  • Restrict management plane access. If patching must be delayed for change-freeze or maintenance-window reasons, immediately isolate the management interface behind a dedicated out-of-band management network. Apply ACLs to block all untrusted sources from reaching the affected service port.
  • Audit management interface exposure. Any Nexus 9000 Silicon One device with a management interface reachable from a non-management network segment should be treated as potentially at risk until patched.
  • Enable logging and alerting on management plane connections for anomaly detection while patches are being staged.

    • For IOS XR (umbrella CVE bundle):


  • Patch is the only option. Cisco has explicitly confirmed no workarounds exist for any IOS XR version. This is unambiguous: if you run IOS XR, you patch.
  • Prioritize devices facing internet-adjacent segments, peering links, or multi-tenant environments where the blast radius of compromise is highest.
  • For carrier and SP environments, coordinate with your NOC on emergency maintenance windows — the two 9.8-rated IOS XR CVEs in particular warrant emergency-change classification.
  • Review Cisco's IOS XR Software Release Recommendations page to identify the appropriate fixed train for your platform.

    • General hardening (applies to both):


  • Segment management traffic onto a dedicated VRF or OOB network where not already done.
  • Enforce SSH key-based authentication for all administrative access; disable Telnet.
  • Validate that no management interfaces are directly reachable from guest, user, or internet-facing VLANs.
  • Subscribe to Cisco's PSIRT feed and configure automated alerting for future critical disclosures.

    • ## References


  • [Cisco Security Advisory: CVE-2026-20212 — Nexus 9000 RCE](https://sec.cloudapps.cisco.com/security/center/publicationListing.x)
  • [Cisco IOS XR Software Hardening Advisory (Umbrella)](https://sec.cloudapps.cisco.com/security/center/publicationListing.x)
  • [Cisco PSIRT Blog](https://blogs.cisco.com/security)
  • [NVD Entry: CVE-2026-20212](https://nvd.nist.gov/vuln/detail/CVE-2026-20212)

    • ---


    ## HackWire Analysis


    The Nexus 9000 disclosure deserves more attention than it's likely to get because the affected hardware isn't in some obscure edge deployment — Silicon One-based Nexus 9000 switches are explicitly Cisco's pitch for hyperscale and large enterprise backbone fabrics. These aren't access-layer devices. They're the switches that move traffic between everything else, and a root shell on one means an attacker can manipulate forwarding at the most fundamental level: inject routes, mirror traffic to exfiltration points, or silently sit between segments for weeks.


    The simultaneous IOS XR disclosure is what should be keeping network engineers up at night. Seven CVEs, two at 9.8, and Cisco's own guidance is "no workaround available for any version" — that's a statement you don't make lightly. IOS XR runs on Cisco's carrier-grade routing platforms: the ASR 9000, the NCS 5500, the 8000 series. These are the devices that ISPs, cloud providers, and large enterprises use to run BGP, MPLS, and segment routing. There is no compensating control they can flip while they wait for a maintenance window. The exposure window between disclosure and patch deployment is measured in days, and threat actors with network infrastructure in their crosshairs — nation-state groups in particular — have demonstrated they monitor Cisco advisories and move fast.


    This also continues a visible pattern: Cisco's management plane has been a recurring source of critical pre-auth vulnerabilities across product lines. The attack surface is predictable, the severity when exploited is total, and defenders keep underinvesting in management plane segmentation because it's unglamorous work. That changes today for anyone running either of these platforms.


    For defenders: the management interface is the kill zone. If it's reachable from anything other than a dedicated OOB segment with strict ACLs, you have a larger problem than just this CVE.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)