Affected Systems

Cisco Silicon One-based Nexus 9000 switches (10 models including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, N9K-C9808) running NX-OS 10.3(1) through 10.6(3s). All Cisco IOS XR devices regardless of version or configuration, including XR7 (LNT) platforms: Cisco 8000 Series, NCS 1010, NCS 540L, NCS 5700 Series, ASR 9000 Series, NCS 1001/1002/1004.

Exploitation Status

No active exploitation reported as of September 2, 2026. Cisco states it is not aware of malicious use of CVE-2026-20212. No public PoC mentioned. However, Cisco notes "the window between disclosure and exploitation has effectively closed" under their new disclosure model.

Business Impact

CVE-2026-20212 allows unauthenticated remote code execution as root on affected Nexus 9000 switches via exposed TCP ports 43210 and 43211 in default Layer 3 VRF. Exploitation can also crash the S1HAL process and reload the device, causing service disruption. IOS XR vulnerabilities (7 umbrella CVEs, 2 rated CVSS 9.8) affect all IOS XR releases with no workarounds available, covering memory safety, access control, missing authentication, and improper certificate validation. Organizations running affected Cisco infrastructure face immediate risk of complete device compromise and network disruption.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all Silicon One-based Nexus 9000 switches using 'show module' command and cross-reference PIDs against Cisco advisory; prioritize internet-facing and management network devices
  • For Nexus 9000: upgrade to NX-OS 10.6(4) or higher per Cisco Software Checker, or deploy Live Protect shield lp00031 on NX-OS 10.6(3) or 10.6(3s) as temporary mitigation
  • Implement infrastructure ACL (iACL) blocking TCP ports 43210 and 43211 to locally configured IP addresses on affected Nexus switches; test in lab environment before production deployment
  • For IOS XR devices: identify current release version and apply corresponding SMUs listed in Cisco advisory for releases 6.9.2 through 26.2.1; XR7 (LNT) platforms require CSCwv19790 SMU across all releases
  • Monitor Cisco TAC for SMU availability on releases 24.1.2, 24.3.2, 25.1.2, and 25.2.2 currently listed as future; plan migration to IOS XR 26.2.2 or 26.3.1 which will include fixes without SMUs