By Heath Callahan
Publication Date: 2026-10-07 14:50:00
Analysis
CVE-2026-20212 lets any unauthenticated attacker achieve root code execution on enterprise data center switches through default TCP ports — the third Cisco infrastructure CVE at 9.8+ in recent weeks.
The discovery of CVE-2026-20212 (CVSS 9.8) in Cisco Nexus 9000 Series switches puts the default-configuration posture of data center backbone infrastructure under a familiar light. The flaw, classified as CWE-1327 – Binding to an Unrestricted IP Address – lets an unauthenticated remote attacker achieve root code execution by sending crafted input to the S1HAL process, which manages the switch’s Silicon One ASICs. That process binds TCP ports 43210 and 43211 to an unrestricted IP address, leaving both ports reachable within the default Layer 3 VRF. Exploitation can also crash the S1HAL process and force a device reload.
Cisco disclosed the vulnerability on September 2, 2026, reporting it was found during a TAC support case resolution. The company is not aware of any…
