A switch that hands over root to anyone who can reach it
Cisco has fixed a flaw in a line of its Nexus 9000 data center switches that requires no username, password, or prior access of any kind. Anyone who can send network traffic to one of two TCP ports on an affected switch can run commands as root, the highest privilege level on the device.
The bug is tracked as CVE-2026-20212 and carries a CVSS score of 9.8 out of 10, the second-highest severity Cisco assigns. Cisco's Product Security Incident Response Team (PSIRT) disclosed it on September 2, 2026, as part of a bundled release of security advisories. As of disclosure, Cisco said it was not aware of any public exploit code or malicious use.
What is actually broken
The affected switches run a management service that binds to an unrestricted IP address instead of limiting itself to trusted interfaces. That mistake leaves TCP ports 43210 and 43211 reachable on the switch's default Layer 3 virtual routing and forwarding (VRF) instance. A remote attacker who can reach either port can send crafted input that the service executes with root privileges, according to Cisco's advisory as reported by The Hacker News. The same flaw can also crash the switch's S1HAL process, an internal component tied to the Silicon One chip, forcing the device to reload.
Cisco's Technical Assistance Center found the issue while working a customer support case, not through a security researcher submission or an attack in progress.
Which switches are affected
The flaw only hits Nexus 9000 models built on Cisco's Silicon One application-specific integrated circuit (ASIC), not the wider Nexus 9000 family. The affected models are:
- N9324C-SE1U
- N9348Y2C6D-SE1U
- N9364E-SG2-O and N9364E-SG2-Q
- N9396T12C-SE1
- N9348Y12C-SE1
- N9396Y12C-SE1
- N9336C-SE1
- N9K-C9804
- N9K-C9808
Other Nexus 9000 models, Nexus 9000 switches running in Cisco Application Centric Infrastructure (ACI) fabric mode, and the older Nexus 3000 and 7000 lines are not affected. On the software side, NX-OS releases 10.3(1) through 10.6(3s) carry the bug, a span of roughly 45 individual releases.
What Cisco recommends
Cisco's primary fix is a software upgrade. Administrators should run the model and current release through Cisco's Software Checker to find the specific fixed train for their device, since the fix version differs by release branch.
For switches that cannot be patched immediately, Cisco has published two stopgaps:
- An infrastructure access control list (iACL) that blocks inbound TCP traffic to ports 43210 and 43211 on the device's locally configured addresses, while still allowing legitimate management and control-plane traffic through.
- A temporary mitigation Cisco calls the Live Protect Shield, available for switches on NX-OS 10.6(3) and 10.6(3s), which does not require a reload to apply.
Neither workaround replaces the upgrade; Cisco frames both as bridges until a fixed image can be installed and tested.
Why this matters more than a typical switch bug
Nexus 9000 switches are commonly deployed as spine or leaf devices at the core of data center networks, carrying traffic for everything connected behind them. A device that can be fully compromised with no credentials sits in a different risk category than a bug requiring stolen passwords or an existing foothold: it can be found and hit by automated internet scanning the moment exploit code exists, a pattern seen repeatedly with past critical flaws in networking appliances that were weaponized within days of disclosure.
The fact that Cisco is not aware of exploitation today is not a reason to wait. Critical, unauthenticated bugs in widely deployed network hardware are reliably targeted once technical write-ups circulate, and root access on a core switch can expose the traffic and configuration of everything routed through it.
What to do about it
Network and security teams running any of the listed Nexus 9000 models should treat this as a same-week action item, not a routine patch cycle item:
- Check whether any deployed switches match the affected model list.
- Confirm whether TCP ports 43210 and 43211 are reachable from outside trusted management networks, and close that exposure immediately regardless of patch status.
- Apply the iACL or Live Protect Shield mitigation if an upgrade cannot happen right away.
- Schedule the NX-OS upgrade to a fixed release identified through Cisco's Software Checker, and verify the fix in a test environment before wide rollout.
