A Port You Never Opened, Reachable Anyway

Cisco dropped a nasty one this week: CVE-2026-20212, a CVSS 9.8 vulnerability in Silicon One-based Nexus 9000 switches that lets an unauthenticated remote attacker execute code as root. No credentials, no MFA bypass, no phishing required. Just TCP.

The root cause is depressingly familiar to anyone who has run `netstat` on a piece of network gear and quietly despaired: a management-plane service binds to an unrestricted IP address instead of loopback or a management VRF, leaving TCP ports 43210 and 43211 reachable in the default Layer 3 VRF. If your switch's data-plane interfaces can route to that address — and on a lot of fabric deployments they absolutely can — an attacker can connect directly to the service. Crafted input sent to that port gets executed with root privileges. Cisco notes exploitation attempts may also crash the S1HAL process and force a reload, so even a failed attack can take your switch down.

The Blast Radius

This isn't some edge-case SKU. Ten Nexus 9000 models built on Cisco's Silicon One ASICs are affected, spanning fixed switches (N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1) up through the big modular chassis (N9K-C9804, N9K-C9808). These are the boxes people put at the core of spine-leaf VXLAN fabrics — exactly where you do not want an unauthenticated root shell showing up.

The patch matrix is where this turns into an actual operational headache: 45 separate NX-OS releases across the 10.3(1) through 10.6(3s) range are affected. Cisco says it isn't aware of active exploitation as of the September 2 disclosure, which is the best-case scenario, but a CVSS 9.8 root RCE on core switching infrastructure has a way of becoming a top exploitation target within days of a public writeup, not weeks.

Cisco September 2026 Patch Burden by Product Line

Mitigate Now, Patch on Your Schedule

If you can't roll a full NX-OS upgrade tonight, Cisco is offering two stopgaps: an infrastructure ACL (iACL) that blocks 43210/43211 at your edge, and — if you're already on 10.6(3) or 10.6(3s) — a temporary Live Protect shield (lp00031) that closes the hole without a reboot. Neither is a substitute for the real fix, but both buy you time to plan a maintenance window instead of doing this at 2am under pressure.

The iACL point deserves its own callout for anyone running Nexus gear at home or in a colo cage: if you have never explicitly written a control-plane policing ACL for your switch management ports, you are trusting the vendor's factory defaults to be correct. They were not correct here. Go check what's listening on your fabric switches right now — `show ip sockets` or the NX-OS equivalent — before you assume this doesn't apply to you.

It Wasn't Just the Nexus

The same week, Cisco also shipped a hardening package for IOS XR covering seven umbrella CVEs (CVE-2026-20274 through CVE-2026-20280), two of which also carry 9.8 scores. SMUs exist for 15 releases, but 93 additional affected IOS XR versions have no direct patch yet — operators on those trains have to upgrade to a covered release before they can even apply the fix. That's the kind of patching load that turns a single disclosure into a quarter-long project for a service provider's core network team.

The Homelab Angle

Most of us aren't running an N9K-C9808 chassis in the garage, but plenty of homelabbers do run secondhand enterprise Nexus and Catalyst gear picked up off eBay for the 25/40/100G ports, and small ISPs and regional providers absolutely run this exact hardware in production. If that's you: this is your reminder that inheriting enterprise gear means inheriting its enterprise attack surface, including services you never configured and didn't know were listening. Segment your management plane onto its own VRF or VLAN, put an ACL in front of it, and don't assume a switch is safe just because it's behind your firewall — VXLAN fabrics route between switches directly, and this vulnerability lives entirely in that reachable Layer 3 space.

If it's not on your own hardware, it's not really yours — but even when it is your hardware, if you didn't audit what the vendor left listening on it, you don't really control it either.