EUVD-2026-81094
GHSA-7m45-wvmr-jx5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 missing authentication for a critical function reachable over the network justifies AV:N/AC:L/PR:N/UI:N; full CIA retained as vendor-asserted worst case for the grouped management-plane issues, S:U.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20326 are related to missing authentication for critical function issues that are grouped under the Common Weakness Enumeration (CWE) CWE-306.
AnalysisAI
Missing authentication for critical functions (CWE-306) in Cisco Nexus Dashboard allows unauthenticated, remote attackers to access protected functionality, resulting in a CVSS 9.8 (Critical) rating with high impact to confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and real-world exploitation requires network reachability to the management interface, which is typically restricted to isolated management networks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the management interface of a Cisco Nexus Dashboard deployment; per CWE-306 and PR:N, no credentials or user interaction are needed to reach the affected critical function(s) against a default installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) describes an unauthenticated, remotely reachable missing-authentication flaw (CWE-306) with full CIA impact, which on paper is a top-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Cisco Nexus Dashboard hardening release referenced in the Cisco security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ndw1-psFvnrg; the exact patched version is not specified in the available data, so administrators should consult the advisory for the recommended software release and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco Nexus Dashboard instance in the environment and confirm which releases are deployed, since the available data does not specify affected versions - validate against Cisco's advisory for this hardening release; immediately eliminate unnecessary network reachability to the management interface by enforcing firewall rules and ACLs so that only approved administrative networks, jump hosts, or VPN segments can connect, and confirm no instance is exposed to the internet. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nexus Dashboard
View allCommand injection (CWE-77) in Cisco Nexus Dashboard allows a remote, authenticated attacker holding low-privilege creden
Improper access control in Cisco Nexus Dashboard, Cisco's data-center orchestration and management appliance, allows a n
Cisco Nexus Dashboard versions 2.1 through 4.2.1 contain information exposure and insecure handling vulnerabilities that
Path traversal (CWE-22) in Cisco Nexus Dashboard lets a remote attacker holding valid low-privileged credentials (CVSS 3
Cisco Nexus Dashboard is affected by multiple SQL injection vulnerabilities (CWE-89) that can be triggered by an authent
Cisco Nexus Dashboard configuration backup feature allows authenticated administrators to extract sensitive authenticati
Cisco Nexus Dashboard Insights metadata update feature allows authenticated administrators to write arbitrary files to t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today