Cisco Nexus 9000 CVE-2026-20212

Exploitation requires network (L3) reachability to TCP ports 43210 and 43211, which are open by default in the Layer 3 default VRF on affected Cisco Nexus 9000 switches running the Silicon One integration - no authentication, credentials, or user interaction are needed. The primary limiting factor is reachability: the attacker must be able to route to the default-VRF interface where these ports listen, so devices whose default VRF is isolated from untrusted networks are not remotely exploitable from those networks. Exploitation is further constrained to Nexus 9000 hardware/NX-OS builds that include the vulnerable S1HAL Silicon One integration.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H aligns with the description - network reachable, no authentication, no user interaction, and full compromise (root) plus device reload. The key limiting factor is network reachability of TCP 43210/43211: an attacker must have an L3 path to the default VRF where the ports are exposed, so exposure is greatest on devices whose management/data interfaces in that VRF are reachable from untrusted segments. EPSS and KEV data are not provided in the input, so exploitation probability and active-exploitation status are unknown; the absence of a listed public PoC means this is not confirmed weaponized, but the unauthenticated root-RCE profile means any operator running affected Nexus 9000 gear should treat it as urgent and patch on an emergency cycle. No exploit code is confirmed available, so realistic near-term risk is targeted rather than mass-automated until a PoC emerges.

An attacker with an L3 network path to an affected Nexus 9000 switch connects to TCP 43210 or 43211 in the default VRF and sends crafted input to the S1HAL process, which is executed as root - giving full control of the switch. Alternatively, the attacker sends malformed input that crashes S1HAL, forcing the device to reload and disrupting the network. No public exploit is identified yet, and the low attack complexity (AC:L) with no authentication means an exploit, once developed, would be straightforward to run.