EUVD-2026-94447
GHSA-w5w6-f4p9-3h6f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to NX-OS with low-privilege account
-
DeliveryAccess device Python interpreter
-
ExploitCall crafted functions with unvalidated input
-
ExecutionEscape Python sandbox
-
ImpactExecute OS commands as the authenticated user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Component isolation
|
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid, authenticated low-privilege account on the NX-OS device (PR:L) and local access to the on-box Python interpreter feature (AV:L) - it cannot be triggered remotely or by an unauthenticated user. The attacker must be able to invoke the specific vulnerable Python interpreter functions that insufficiently validate user-supplied input. Limiting factors: no remote network vector, no privilege escalation beyond the existing user context (so value is highest where the Python sandbox is relied upon to confine semi-trusted operators), and exposure is confined to NX-OS deployments where interpreter access is granted to such accounts; consult Cisco advisory cisco-sa-nxos-mppe-dhKZAFgb for affected platforms and versions. |
| Impact | This is a moderate, defense-in-depth issue rather than a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.4 Medium) confirms the attack is local only and requires an already-authenticated, low-privilege account on the device - it is not remotely reachable and grants no privilege escalation beyond the attacker's existing user context (impacts are Low/Low/None). There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; all signals point to low real-world urgency. The main caveat: a Python-sandbox escape that reaches the underlying OS is a meaningful security-boundary crossing, and Cisco scored scope as Unchanged (S:U) even though sandbox-to-host escape is arguably a scope change - defenders who already treat NX-OS CLI access as trusted will see little marginal risk, while environments that rely on the Python sandbox as a confinement control for semi-trusted operators should prioritize patching. No conflicting signals between the CVSS vector and the description; both agree on authenticated local access. |
| Exploit ScenarioDerived | An operator or semi-trusted user who already has low-privilege CLI/Python-interpreter access to a Cisco NX-OS switch invokes crafted calls to specific interpreter functions that insufficiently validate input, breaking out of the Python sandbox. They then run arbitrary OS commands on the switch as their own authenticated user, gaining access the sandbox was meant to deny. No public exploit code is identified at time of analysis, and the local-only, authenticated nature (AV:L/PR:L) significantly limits who can attempt it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Python sandbox escape in Cisco NX-OS allows an authenticated, local attacker with low privileges to break out of the on-box Python interpreter sandbox and run arbitrary commands on the underlying operating system with that user's privileges. The issue arises from insufficient validation of user-supplied input in specific interpreter functions, affecting NX-OS software per the vendor CPE, and requires local access plus a valid low-privilege account rather than remote or unauthenticated access. No public exploit identified at time of analysis; CVSS 4.4 reflects limited confidentiality and integrity impact, and Cisco has published advisory cisco-sa-nxos-mppe-dhKZAFgb for affected platforms and versions.
RemediationAI
No exact fixed version is specified in the provided data, so consult Cisco advisory cisco-sa-nxos-mppe-dhKZAFgb for the patched NX-OS releases and upgrade to the recommended version; if the advisory lists a fixed release for your platform, apply it after standard change-control validation. Until upgrading, restrict the on-box Python interpreter to trusted administrative accounts by removing low-privilege users from Python/guest-shell access and tightening AAA/RBAC policies, or disable the Python sandbox feature where it is not required; the trade-off is loss of automation and scripting capability for affected operators. Monitor device logs for unusual Python invocations or unexpected OS command execution by low-privilege accounts, and treat the issue as a defense-in-depth control gap rather than a remotely exploitable emergency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Python interpreter feature on Cisco NX-OS devices, an on-box automation and scripting environment often used by operators, and the root-cause CWE-653 (Improper Isolation or Compartmentalization) describes a sandbox that does not adequately separate untrusted Python execution from the host OS. Insufficient validation of user-supplied input permits an attacker with an existing low-privilege local account to manipulate specific Python functions and escape the sandbox, executing OS commands with the privileges of that authenticated user. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N confirms local access, low privileges, no user interaction, no scope change, and only low confidentiality and integrity impact, so this is not a remote code execution flaw and does not grant privilege escalation beyond the user's existing context. The CPE cpe:2.3:a:cisco:cisco_nx-os_software:*:*:*:*:*:*:*:* indicates Cisco NX-OS Software is the affected product family; exact platform and release coverage should be verified in Cisco advisory cisco-sa-nxos-mppe-dhKZAFgb.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Requires an authenticated low-privilege local user and the on-box interpreter, so AV:L/PR:L/AC:L; impact is bounded by the user's own privileges, giving C:L/I:L/A:N.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB