Cisco has published a critical advisory for its Nexus 9000 series data center switches: CVE-2026-20212, a CVSS 9.8 vulnerability that lets an unauthenticated remote attacker execute arbitrary code as root on any affected switch they can reach over the network. Cisco’s PSIRT says it has no evidence of exploitation or public proof-of-concept as of September 3, 2026, but the bug is trivial to weaponize once someone reverse-engineers the fix, and these boxes sit at the core of production data center fabrics — including the AI/ML clusters Cisco has been selling Silicon One hardware into.
What happened
The flaw is tracked as CWE-1327, binding to an unrestricted IP address. On Nexus 9000 switches built around Cisco’s Silicon One ASIC, an internal hardware-abstraction service (S1HAL) binds to TCP ports 43210 and 43211 on all interfaces in the default Layer 3 VRF, with no authentication and no access restriction. Any host that can route a packet to those ports can send crafted input that the service processes with root privileges — no credentials, no user interaction, no prior foothold.
A malformed request can also crash the S1HAL process outright, reloading the switch, so even a failed exploitation attempt can trigger a denial-of-service outage on a production fabric switch.
Critically, “unauthenticated” here doesn’t require internet exposure. Cisco’s advisory is explicit that a switch does not need to face the internet to be at risk — anything that can reach the management or control-plane network segment where 43210/43211 are exposed, including a compromised workstation or a pivot from another compromised device, can reach the flaw. In most real deployments that’s a large population: any host on the same VRF or a routed segment behind a misconfigured ACL.
Affected hardware
The advisory lists Nexus 9000 fixed and modular chassis built on Silicon One silicon, including N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Cisco’s CVE record enumerates roughly 45 affected NX-OS release trains starting at 10.3(1) through builds in the 10.6(3) line. Switches without Silicon One ASICs are not affected.
Why it matters
Nexus 9000 switches are the leaf/spine backbone of a huge number of enterprise and hyperscale data center fabrics, and the Silicon One variants specifically are Cisco’s play for high-bandwidth AI training and inference clusters. A root compromise at this layer isn’t “one server got popped” — it’s an attacker sitting on the fabric with the ability to manipulate forwarding, mirror or intercept east-west traffic between workloads, and pivot into every segment the switch touches. For an AI data center fabric in particular, that’s the traffic between GPU nodes, storage, and orchestration control planes — exactly the layer segmentation and zero-trust architectures assume is out of reach.
The DoS angle compounds this: even a security team just probing for the vulnerability with an imperfect payload could crash S1HAL and reload a core switch, so this needs to be tested carefully, not blasted at production fabric.
What to do right now
- Patch. Cisco has not published a simple fixed-version table for this one — use the Cisco Software Checker against your specific NX-OS release and hardware ID to get the correct fixed build.
- If you can’t patch immediately, deploy an infrastructure ACL (iACL) that denies TCP traffic to ports 43210 and 43211 on the switch’s locally configured addresses, permitting only required management and control-plane traffic. Cisco has validated this workaround and also shipped a temporary Cisco Live Protect shield, but neither replaces the software fix.
- Audit reachability to those ports from anything other than trusted management infrastructure — don’t assume “not internet-facing” means “not reachable.” Compromised internal hosts and lateral movement paths count.
- Watch for S1HAL crashes/reloads in switch logs as a possible indicator of scanning or exploitation attempts, even before public PoC surfaces.
Full details are in Cisco’s advisory, published as cisco-sa-n9k-s1-rce-EH8dEtr on the Cisco Security Advisories portal.