Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Summary: Cisco patched a critical flaw, CVE-2026-20212 (CVSS 9.8), in 10 Silicon One-based Nexus 9000 switches where binding to an unrestricted IP address leaves TCP ports 43210 and 43211 reachable in the default Layer 3 VRF, letting an unauthenticated remote attacker send crafted input that executes as root and can also crash the S1HAL process and reload the device. The same September 2 disclosure included an IOS XR hardening release with 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 and CVE-2026-20279), affecting all releases regardless of configuration with no workaround, and Cisco said it was not aware of malicious use of the Nexus flaw as of disclosure.
Bottom line: Of the 111 IOS XR releases Cisco lists as affected, 14 have SMUs available today, four are awaiting them, and 93 must be upgraded before a fix can be applied - and this lands six days after Sygnia reported the China-nexus actor Fire Ant running implants on IOS XR routers that suppressed syslog and hid a GRE tunnel.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-20212 CVE-2026-20274 CVE-2026-20275 CVE-2026-20279 CVE-2026-20280
Related: ⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026