Cisco Nexus Dashboard EUVD-2026-17935

The CVSS 6.5 score reflects a high-privilege prerequisite (PR:H), meaning only administrators or users with backup access can initiate the attack chain. However, this requirement warrants careful context: if backup files are stored with weak access controls or transmitted insecurely, the actual attack surface expands significantly beyond intended administrators. The network attack vector (AV:N) and low attack complexity (AC:L) indicate straightforward exploitation once prerequisites are met. The high confidentiality and integrity impact (C:H, I:H) reflects the ability to extract credentials and potentially modify system configurations. EPSS data is not provided, but the requirement for an existing backup file and encryption password substantially limits real-world exploitation probability compared to the CVSS score alone suggests. The absence of KEV (CISA known exploited vulnerabilities) status and public proof-of-concept code indicates this is not yet an active threat in the wild, reducing immediate priority despite the severity of potential impact. Organizations should prioritize based on backup file storage security and the sensitivity of their Nexus Dashboard deployments.

A disgruntled IT administrator with legitimate access to Nexus Dashboard obtains a configuration backup file and its encryption password, then uses offline tools to decrypt the backup and extract embedded API credentials. The attacker then uses these credentials to authenticate to the Nexus Dashboard's internal APIs from an external network, bypassing the normal authentication layer, and executes arbitrary commands with root privileges to exfiltrate sensitive data or establish persistent access. Alternatively, a backup file could be compromised during storage or transmission by an external attacker if access controls are misconfigured, exposing the same attack path without requiring insider access.