Cisco Nexus Dashboard CVE-2026-20174

Despite a CVSS score of 4.9, this vulnerability presents a moderate real-world risk with important context. The CVSS vector shows unauthenticated network access (AV:N/AC:L) but requires high-privilege authentication (PR:H), significantly limiting the threat actor pool to individuals already possessing administrative credentials. The integrity impact is high (I:H), meaning successful exploitation can modify critical system files. No evidence of active exploitation (KEV status not provided), no public exploit code (POC status not provided), and no EPSS score provided, so real-world exploitation probability cannot be assessed from threat intelligence. The attack is not automatable due to the authentication requirement and manual upload step. Organizations using cloud-connected Intersight deployments are at lower risk because manual metadata uploads are not the typical deployment model there, whereas air-gap environments where manual uploads are standard practice face elevated risk if an internal threat actor with admin access turns malicious.

An insider threat or compromised administrator with valid credentials could craft a malicious metadata file containing path traversal sequences (e.g., ../../../etc/cron.d/) and upload it through the manual metadata update interface. Upon processing, the system would write files outside the intended metadata directory to arbitrary locations on the underlying operating system with root privileges, potentially establishing persistence, modifying security settings, or executing arbitrary commands. This attack is practical in air-gap environments where manual uploads are routine operational procedures and where file upload validation may be less stringent than cloud-connected deployments.