Cisco Nexus Dashboard CVE-2026-20361

Requires a valid authenticated session on the Cisco Nexus Dashboard management interface at a low privilege level (PR:L) - no user interaction and no special non-default configuration are indicated. The attacker must reach the Nexus Dashboard web/API surface over the network (AV:N), which in typical deployments is confined to a management network rather than internet-exposed, and must possess or obtain account credentials. The exact vulnerable feature/parameter is not specified because the advisory groups multiple internally-found SQL injection issues; there is no evidence any pre-authentication path exists. The authentication requirement plus the typically-segmented management-plane exposure are the primary factors limiting real-world exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a remotely reachable, low-complexity SQL injection requiring only low-privilege authentication, yielding full confidentiality, integrity, and availability impact on the Nexus Dashboard database backend. No EPSS score, SSVC decision, or KEV listing is provided, and no public exploit code is referenced, so there is no signal of active or imminent exploitation. This is a genuine, credibly-scored authenticated flaw rather than an inflated high-CVSS-low-real-risk issue, but two factors temper priority: it was discovered internally by Cisco (not by external actors or observed in the wild), and it is bundled into a grouped hardening advisory covering 'multiple internally discovered vulnerabilities,' meaning the specific injectable endpoints, parameters, and affected versions are not disclosed. The PR:L requirement (a valid Nexus Dashboard account) is the main real-world limiter. The C:H/I:H/A:H triad is somewhat generous vendor boilerplate for a SQLi but defensible given database read/write/DoS potential. Treat as a high-priority patch for exposed/multi-tenant Nexus Dashboard instances, but exploitation likelihood is currently unquantified - no EPSS or KEV to corroborate.

An attacker with a low-privilege but valid Nexus Dashboard account (or one obtained via phishing/credential reuse) sends crafted input to a vulnerable web/API parameter that is concatenated into a backend SQL query, injecting attacker-controlled SQL. This lets them read or modify database contents beyond their authorization - extracting credentials/config, tampering with records, or disrupting the service. No public proof-of-concept is referenced, and exploitation requires authentication, so opportunistic mass exploitation is unlikely.