SNMP
CVE-2026-20048
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to SNMP subsystem
-
ExploitSend continuous SNMP queries to specific MIB
-
ExecutionTrigger improper request parsing
-
ImpactKernel panic and device reload
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Cisco Nexus 9000 Series Fabric Switches in ACI mode with SNMP enabled. Attacker requires valid SNMP credentials (authenticated remote access). Target must be reachable via network SNMP protocol on default or configured SNMP port. |
| Impact | CVSS 7.7 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to cause a kernel panic on the device, resulting in a reload and a DoS conditi. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Improper SNMP request parsing in Cisco Nexus 9000 Series switches running ACI mode allows authenticated remote attackers to trigger kernel panics and device reloads by sending specially crafted queries to specific MIBs. An attacker with valid SNMP read-only community credentials can exploit this vulnerability across SNMP versions 1, 2c, and 3 to achieve denial of service. No patch is currently available for this vulnerability.
Earlier versions of this analysis (1)
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. [CVSS 7.7 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected ProductsAI
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP queries to a specific MIB of an affected device. A successful exploit could allow the attacker to cause a kernel
Know when SNMP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP queries to a specific MIB of an affected device. A successful exploit could allow the attacker to cause a kernel panic on the device, resulting in a reload and a DoS condition. Note: This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv1 or SNMPv2c, the attacker must have a valid read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.
Executive ViewAI
Cisco Nexus 9000 Series switches running ACI mode are vulnerable to a remotely-triggered denial of service attack by authenticated users, potentially disrupting network infrastructure and services. Organizations operating these switches in production environments should prioritize assessment and mitigation to prevent network outages.
Restrict SNMP access via network ACLs to authorized management subnets only; disable SNMP service entirely if not operationally required; enforce SNMPv3 with strong authentication and encryption; implement rate limiting on SNMP queries; monitor SNMP traffic for anomalous patterns; segment ACI fabric management networks from general corporate networks; enable detailed logging of SNMP authentication attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Hardcoded/insecure credentials in IDC SFX Series SuperFlex Satellite Receiver. Multiple accounts with known credentials
html5_snmp 1.11 has multiple SQL injection vulnerabilities allowing attackers to manipulate SNMP monitoring database que
SQL injection in LibreNMS 25.12.0 and below. PoC and patch available.
SQL injection in LibreNMS versions 25.12.0 and below allows authenticated users to extract sensitive database informatio
Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap
html5_snmp 1.11 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scrip
Reflected cross-site scripting in LibreNMS versions 25.12.0 and earlier allows unauthenticated remote attackers to injec
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS versions 26.1.1 and below allows authenticated administrators to inject malicious scripts through
Stored XSS in LibreNMS Alert Rules allows authenticated administrators to inject malicious scripts that execute when oth
Incorrect privilege assignment in Huawei openUBMC causes the SNMP pseudo-identity group (special_users, including the SN
Stored cross-site scripting in LibreNMS versions 24.10.0 through 26.1.1 allows authenticated users to inject malicious s
GitHub PoC
Exploit-DB