EUVD-2026-81096
GHSA-pvpj-7fmm-5p8q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated (PR:L) network access-control flaw on the mgmt plane crossing a scope boundary (S:C); full C/I/A retained as vendor-asserted worst case for the grouped bundle.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20322 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
AnalysisAI
Improper access control in Cisco Nexus Dashboard, Cisco's data-center orchestration and management appliance, allows a network-positioned attacker who already holds a valid low-privileged account to exceed their intended permissions, with the scope-change (S:C) scoring producing full confidentiality, integrity, and availability impact. Cisco rates the flaw CVSS 9.9 (Critical) under vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; because PR:L is required, this is explicitly an authenticated flaw - a legitimate or stolen operator-level credential is a prerequisite, and it is not unauthenticated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session on Cisco Nexus Dashboard: the CVSS PR:L means a valid low-privileged account (or stolen credentials) is a prerequisite - this is not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a vendor-scored CVSS 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a network-reachable, low-complexity, authenticated (PR:L) improper-access-control flaw whose scope-change (S:C) yields full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - Cisco remediated these internally discovered access-control issues in a dedicated software hardening release, and the exact Nexus Dashboard build to upgrade to is listed in the 'Fixed Software' table of Cisco advisory cisco-sa-hardening-ndw1-psFvnrg (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ndw1-psFvnrg); no individual version numbers are enumerated in the CVE data itself, so consult that advisory rather than guessing at a target version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Nexus Dashboard instance to confirm which deployments are reachable from anything other than the internal management network, and constrain or allowlist access so only authorized administrative subnets can reach the management interface; at the same time, enumerate all accounts with operator-level or lower privileges, disable or expire any that are unused, and force credential rotation on shared and service accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nexus Dashboard
View allCommand injection (CWE-77) in Cisco Nexus Dashboard allows a remote, authenticated attacker holding low-privilege creden
Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attacker
Cisco Nexus Dashboard versions 2.1 through 4.2.1 contain information exposure and insecure handling vulnerabilities that
Path traversal (CWE-22) in Cisco Nexus Dashboard lets a remote attacker holding valid low-privileged credentials (CVSS 3
Cisco Nexus Dashboard is affected by multiple SQL injection vulnerabilities (CWE-89) that can be triggered by an authent
Cisco Nexus Dashboard configuration backup feature allows authenticated administrators to extract sensitive authenticati
Cisco Nexus Dashboard Insights metadata update feature allows authenticated administrators to write arbitrary files to t
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today