Cisco Nexus Dashboard CVE-2026-20325

Requires authenticated access to the Cisco Nexus Dashboard management interface (PR:L) - an attacker must already possess valid low-privilege credentials or a session, which is the primary limiting factor. Given AV:N/AC:L/UI:N, once authenticated the injection is reachable over the network with low complexity and no user interaction. The grouped hardening advisory does not enumerate a specific feature toggle or non-default configuration prerequisite for CVE-2026-20325, so it should be assumed reachable in standard deployments of affected Nexus Dashboard versions; consult the Cisco advisory fixed-release table for exact affected versions.

This is a vendor-asserted 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) command-injection flaw (CWE-77) in Cisco Nexus Dashboard, disclosed as part of a grouped internal 'hardening release' advisory (cisco-sa-hardening-ndw1-psFvnrg) rather than an externally-reported single-issue advisory. The score reflects genuinely high-impact shape - network-reachable, low-complexity, authenticated (PR:L), with a scope change (S:C) and full C:H/I:H/A:H - but every impact metric is Cisco-asserted from an internal review with no per-CVE technical breakdown. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis.' The key mitigating signal is PR:L: an attacker needs valid credentials/authenticated access to the Nexus Dashboard, which meaningfully limits the unauthenticated internet-scan threat despite AV:N. Net: a real patch-priority item for organizations running Nexus Dashboard because of the RCE-class impact and low complexity, but the absence of active-exploitation or POC signals and the authentication requirement argue for prompt scheduled patching rather than emergency response. Note the grouped-advisory format means precise affected version boundaries and per-CVE conditions are not enumerated in the provided data - verify against the Cisco advisory fixed-release table.

An attacker with valid low-privilege authenticated access to a Cisco Nexus Dashboard instance submits crafted input to a function that passes it to a system command without proper neutralization, injecting OS commands that execute in the underlying platform context. Because the scope changes (S:C), the attacker can pivot beyond the vulnerable component to impact the broader orchestration platform and the fabric it manages. No public exploit code is identified at time of analysis; the flaw was internally discovered by Cisco.