CVE-2026-20212

criticalPriorität · beachten · 49EPSS 0.008 · 57. PerzentilExploit · PoCNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.83% (57th) EPSS

CVSS 9.8 · critical

Is it mine?

98 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

fstec_bdu · cisco_csaf · ncsc_nl

EPSS · bewertet 2026-10-27

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.4(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.5(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(2n) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(2s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco NX-OS Software 10.6(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2n) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · psirt@cisco.com USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1327USCWE-1327USCWE-1327US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

HORKimhab/CVE-2026-20212CVE-2026-20212 - Draft or TODOPoC · poc_in_github

betroffene Produkte (98)

Betroffene Produkte und Versionsbereiche.

20 von 98 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0338Kwetsbaarheden verholpen in Cisco Nexus 9000 Series, IOS XR Software en Secure EmailNL2026-09-03csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Cisco Nexus 9000 Series Switches met Silicon One technologie, Cisco IOS XR Software en Cisco Secure Email.
cisco-sa-n9k-s1-rce-EH8dEtrCisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability2026-09-02csaf · cisco_csafUS
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

auch bekannt als (1)

Weitere Namen und Kennungen dieser Entität.

BDU:2026-15586 fstec_bdu

quellen

Welche Quellen diesen Datensatz belegen und wann.

fstec_bdu cisco_csaf ncsc_nl NVD CVE.org MITRE

veröffentlicht 2026-09-02geändert 2026-09-30

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan