Ten switch models. Two open TCP ports. Root on the fabric that carries your AI training traffic.
CVE-2026-20212 — CVSS 9.8 — unauthenticated remote code execution as root on Cisco Nexus 9000 Series switches built on the Silicon One ASIC. Disclosed September 2, 2026 (cisco-sa-n9k-s1-rce-EH8dEtr).
WHAT ACTUALLY HAPPENED
The Silicon One integration in NX-OS binds a service to an unrestricted IP address — CWE-1327. The result: TCP ports 43210 and 43211 are reachable in the default Layer 3 VRF.
Send crafted data to that listener and it executes with root privileges. No credentials. No user interaction. It can also crash the affected process and force a device reload — so the same flaw is both RCE and denial of service.
Cisco did not find this through a bug bounty or a red team. Engineers hit it while resolving an unrelated TAC support case.
Ten Silicon One-based Nexus 9000 models are affected. Nexus 3000, Nexus 7000, most other Nexus 9000 variants, MDS 9000, Firepower and UCS fabric interconnects are not. Cisco PSIRT reported no known exploitation at publication. Fixed releases are available.
WHY LOSING THE FABRIC IS WORSE THAN LOSING A SERVER
A compromised server is one workload. A compromised leaf or spine is every workload that transits it.
Root on a data centre switch means arbitrary traffic mirroring, silent ACL changes, route injection, and a persistence point that no EDR agent watches and no vulnerability scanner logs into. Network devices are the least monitored tier in most estates and the most privileged.
The detail that should worry you is the default VRF. Many teams assume these services are confined to a management VRF and firewalled accordingly. Here the listener sits in the data-plane VRF — the one that reaches your compute, your storage and, in AI builds, your GPU fabric.
If your east-west segmentation assumes the switch itself is not a target, that assumption just expired.
WHAT TO DO NOW
INVENTORY BY ASIC, NOT BY MODEL NAME — the exposure follows Silicon One, so confirm the platform rather than trusting the Nexus 9000 label.
PROBE PORTS 43210 AND 43211 FROM THE DATA PLANE — test from where an attacker would actually sit, not from your management jump host.
PATCH, THEN RESTRICT — apply the fixed release, and until you can, Cisco's own mitigation is an infrastructure ACL blocking those two ports.
TREAT SWITCHES AS MONITORED ASSETS — ship NX-OS syslog and config diffs to your SIEM, because an unexplained reload is a detection signal here.
Your firewalls are useless if the thing forwarding packets to them is owned.
Do you know which of your switches expose services in the default VRF today?