CVE-2026-20212

criticalpriority · attend · 49EPSS 0.008 · 57 %ileexploit · PoCNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.83% (57th) EPSS

CVSS 9.8 · critical

Is it mine?

98 products

Check your exposure

Who says so?

3 sources

fstec_bdu · cisco_csaf · ncsc_nl

EPSS · scored 2026-10-27

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.4(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.5(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(2n) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(2s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedCisco NX-OS Software 10.6(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
WorkaroundCisco NX-OS Software 10.3(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3q) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3r) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(3x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4a) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(4h) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(8) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(9) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(99w) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.3(99x) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(4g) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(6) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.4(7) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3e) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3o) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3p) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(3t) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(4) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.5(5) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(1) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(1s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2n) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(2s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(3) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].
WorkaroundCisco NX-OS Software 10.6(3s) when installed on Cisco Nexus 9000 Series Switchescisco_csaf
There is a workaround that addresses this vulnerability. To prevent remote exploitation of this vulnerability, use infrastructure access control lists (iACLs) to allow only required management and control plane traffic that is destined to the affected device. Alternatively, the iACLs may be used to explicitly deny all TCP packets that are destined to a locally configured IP address with a destination port of 43210 or 43211. For more information about iACLs, see the Cisco NX-OS Software Hardening Guide ["https://sec.cloudapps.cisco.com/security/center/resources/securing_nx_os.html"]. While this workaround has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Live Protect Shields Cisco has released a Live Protect shield for CVE-2026-20212 ["https://software.cisco.com/download/products?swtypemdfid=286346710&relver=10.6(3)"] to temporarily mitigate this vulnerability in Cisco NX-OS Software. For information about Live Protect for Cisco NX-OS Software, see Cisco Nexus 9000 Series NX-OS Security Configuration Guide ["https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/106x/configuration/security/cisco-nexus-9000-series-nx-os-security-configuration-guide-release-106x/m-secure-nx-os-with-live-protect.html"]. Note: Live Protect shields are temporary mitigations to bridge the gap until software updates can be scheduled. To fully remediate this vulnerability, upgrade to a fixed software release, which can be found using the Cisco Software Checker ["https://sec.cloudapps.cisco.com/security/center/softwarechecker.x"].

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · psirt@cisco.com USexploitability 3.9 · impact 5.9

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1327USCWE-1327USCWE-1327US

exploits (1)

Public proof-of-concept and weaponised exploit code.

HORKimhab/CVE-2026-20212CVE-2026-20212 - Draft or TODOPoC · poc_in_github

affected products (98)

Products and version ranges known to be affected.

showing 20 of 98

advisories (2)

Vendor and ecosystem advisories describing this.

NCSC-2026-0338Kwetsbaarheden verholpen in Cisco Nexus 9000 Series, IOS XR Software en Secure EmailNL2026-09-03csaf · ncsc_nlNL
Cisco heeft kwetsbaarheden verholpen in Cisco Nexus 9000 Series Switches met Silicon One technologie, Cisco IOS XR Software en Cisco Secure Email.
cisco-sa-n9k-s1-rce-EH8dEtrCisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability2026-09-02csaf · cisco_csafUS
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload. Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

also known as (1)

Other names and identifiers for this entity.

BDU:2026-15586 fstec_bdu

sources

Which sources assert this record, and when.

fstec_bdu cisco_csaf ncsc_nl NVD CVE.org MITRE

published 2026-09-02modified 2026-09-30

references (1) nvd

External citations — patches, advisories, analysis.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n9k-s1-rce-EH8dEtr

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan