EUVD-2026-94446
GHSA-8r87-mj76-xw8h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Unauthenticated network packets (AV:N/PR:N/UI:N/AC:L) defeat policy enforced for other endpoints, so S:C with I:L only; no confidentiality or availability loss.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.
This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.
AnalysisAI
EPG contract bypass in Cisco Nexus 9000 Series Fabric Switches running ACI Mode allows an unauthenticated, remote attacker to evade configured endpoint-group segmentation by sending IPv4 or IPv6 UDP packets with DHCP source and destination ports (67/68) through the device. The flaw is an improper access-control implementation (CWE-284) rated CVSS 5.8 with scope change and low integrity impact; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the affected Cisco Nexus 9000 switch be running in ACI mode and be configured to enforce EPG contracts for traffic segmentation; the attacker must be able to send packets through the device and specifically must use UDP source and destination ports assigned to DHCP traffic (67/68) within IPv4 or IPv6 packets to trigger the improper contract handling. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity access-control weakness (CVSS 5.8, CWE-284) that should be treated as a configuration-integrity/segmentation-bypass issue rather than a system-compromise priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not specified in the provided data; consult Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf for fixed NX-OS in ACI mode releases and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Un
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified C
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in A
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote,
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affecte
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today