In addition to an IOS XR hardening release that bundles seven umbrella CVEs, two of which are rated 9.8, with no workaround for any IOS XR version, Cisco has released patches to address a critical security flaw affecting ten Silicon One-based Nexus 9000 switches that could allow an unauthenticated, remote attacker to execute code as root.
The Nexus vulnerability, identified as CVE-2026-20212 (CVSS score: 9.8), involves binding to an uncontrolled IP address that allows the default Layer 3 virtual routing and forwarding (VRF) instance to access TCP ports 43210 and 43211.
An attacker can establish a direct connection to the service if they are able to access a switch’s IP on either port. After being delivered to that service, crafted input is run as root-level code. Additionally, an attempt at exploitation may cause the S1HAL process to crash and force a device restart.
As of its September 2 disclosure, Cisco stated that it was unaware of any malicious use of the vulnerability. With a temporary Live Protect shield and an infrastructure access control list (iACL) blocking the two ports as stopgaps, it has not released a fixed-release table and points clients to its Software Checker.
Customers of IOS XR, including those running IOS XR7 (LNT), are instructed by Cisco to update to a release containing software maintenance updates (SMUs) and subsequently install them read more about Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.