Cisco Nexus Dashboard CVE-2026-20322

Requires an authenticated session on Cisco Nexus Dashboard: the CVSS PR:L means a valid low-privileged account (or stolen credentials) is a prerequisite - this is not unauthenticated. No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) to the management-plane interface. Limiting factors: Nexus Dashboard is an internal data-center orchestration appliance typically deployed on management networks rather than exposed to the internet, so reachability is usually constrained to operators and adjacent infrastructure; the flaw is grouped improper access control under a hardening release, so the exact vulnerable feature/function is not individually enumerated in the advisory. Applying the specific fixed hardening release remediates it.

This is a vendor-scored CVSS 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a network-reachable, low-complexity, authenticated (PR:L) improper-access-control flaw whose scope-change (S:C) yields full confidentiality, integrity, and availability impact. However, the risk signals are thin and partly asserted rather than demonstrated: there is NO EPSS score, NO CISA KEV listing, and NO public POC - exploitation status is 'no public exploit identified at time of analysis.' The advisory is a grouped 'software hardening release' that bundles multiple internally discovered vulnerabilities under a single CVE and CWE-284, so the C:H/I:H/A:H/S:C impact is vendor-asserted for the worst case in the bundle rather than tied to a specific reproducible primitive. Because exploitation requires valid low-privileged authentication (PR:L), real-world risk is materially lower than the 9.9 headline for internet-exposed default installs - Nexus Dashboard is an internal data-center management plane, not typically internet-facing. Net: patch on a normal-to-expedited cycle for a management appliance, but the absence of EPSS/KEV/POC plus the vague grouped nature means this is a high-CVSS-with-authentication-gate issue rather than confirmed mass-exploitation. No SSVC decision data was supplied to corroborate automatability or exploitation maturity.

An attacker who already holds a valid low-privileged Nexus Dashboard account (or has compromised such credentials) sends crafted requests to an access-control-deficient function on the management plane, escalating privileges or reaching resources across a scope boundary (S:C) to compromise the dashboard and, potentially, the fabric it administers. No public exploit code or active exploitation is currently identified, and the requirement for authenticated access limits opportunistic use.