Cisco patched a critical Nexus 9000 vulnerability, CVE-2026-20212, allowing unauthenticated remote root code execution.

Cisco has released patches for a critical flaw, tracked as tracked as CVE-2026-20212 (CVSS score of 9.8) in 10 Silicon One-based Nexus 9000 switches. The vulnerability could let an unauthenticated remote attacker execute code with root privileges.

Cisco’s Technical Assistance Center (TAC) discovered the flaw while investigating a customer support case.

The flaw exists because TCP ports 43210 and 43211 are exposed through the default Layer 3 VRF. An attacker could connect remotely and send specially crafted data that gets executed with root privileges. The attack could also crash the S1HAL process, potentially forcing the affected device to reload.

“A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges.” reads the advisory. “This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges. The exploitation of this vulnerability could also cause the S1HAL process to crash, which could cause the device to reload.”

The vulnerability affects Cisco Nexus 9000 Series switches equipped with a Silicon One ASIC.

At the time of disclosure, the following models were known to include the affected Silicon One hardware:

• N9324C-SE1U
• N9348Y2C6D-SE1U
• N9364E-SG2-O
• N9364E-SG2-Q
• N9396T12C-SE1
• N9348Y12C-SE1
• N9396Y12C-SE1
• N9336C-SE1
• N9K-C9804
• N9K-C9808

Administrators can check the Product ID (PID) of a switch by running the show module command. For example, the output below shows N9336C-SE1, which is one of the affected models.

Other Nexus 9000 models are not affected. The same applies to Nexus 9000 switches running in ACI mode, as well as the Nexus 3000 and Nexus 7000 series.

Cisco provides a workaround to reduce the risk of remote exploitation. Administrators can use infrastructure access control lists (iACLs) to allow only the management and control traffic that the affected switch actually needs. Another option is to block TCP traffic to locally configured IP addresses on ports 43210 and 43211.

Cisco has also released a Live Protect shield for CVE-2026-20212. The shield provides temporary protection while organizations prepare to install the proper software update.

However, Cisco recommends upgrading to a fixed NX-OS release as the permanent solution. Before deploying any workaround or mitigation, administrators should test it in their own environment, as it could affect network functionality or performance.

Cisco says its Product Security Incident Response Team (PSIRT) is not aware of any public disclosure or active exploitation of this vulnerability.

“The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.” concludes the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco)

Cisco patched nine critical flaws, including six rated CVSS 10.0, found during internal testing. None are known to be exploited.

Cisco released another batch of security fixes for its Crosswork platforms and Secure Workload software, part of what it’s calling an ongoing internal security review, and the CVSS scores in this round are unusually severe.

“As part of Cisco’s ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.” reads the advisory. “These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and to streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class – Common Weakness Enumeration (CWE) – and assigned a single Common Vulnerabilities and Exposures Identifier (CVE ID) to each CWE grouping.”

Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, all impacting these products regardless of how they’re configured:

• CVE-2026-20030 (CVSS score: 10.0) – an SQL injection vulnerability that lets an attacker manipulate database queries directly.
• CVE-2026-20357 (CVSS score: 10.0) – a missing authentication for critical function vulnerability, meaning a sensitive operation can be triggered without ever proving who you are.
• CVE-2026-20358 (CVSS score: 10.0) – an external control of file system vulnerability, letting an outside actor influence which files the system reads or writes.
• CVE-2026-20359 (CVSS score: 9.9) – an insufficiently protected credentials vulnerability, where stored login material isn’t locked down the way it should be.

Seeing three CVSS 10.0 vulnerabilities in a single Cisco advisory is unusual. The four flaws affect Crosswork 7.2.1 and earlier, and Cisco fixed them in version 7.2.1-SP.

Five more vulnerabilities got patched in Cisco Secure Workload, spanning both its cloud SaaS and on-premises deployments:

• CVE-2026-20231 (CVSS score: 9.9) – a set of improper neutralization of special elements vulnerabilities covering command, operating system, and argument injection, essentially several different ways to smuggle unintended commands into the system.
• CVE-2026-20315 (CVSS score: 10.0) – a set of improper access control vulnerabilities spanning authorization, authentication, privileges, and bypasses, a broad category that generally means the system doesn’t reliably enforce who’s allowed to do what.
• CVE-2026-20317 (CVSS score: 10.0) – a set of improper authentication vulnerabilities covering missing authentication, authentication bypass, and reliance on untrusted inputs, another maximum-severity cluster centered on identity verification failing outright.
• CVE-2026-20318 (CVSS score: 9.6) – a set of improper input validation vulnerabilities spanning input validation, path traversal, and external path control, the kind of flaw that lets crafted input reach files or directories it was never meant to touch.
• CVE-2026-20319 (CVSS score: 7.5) – a set of improper restriction of operations within the bounds of a memory buffer vulnerabilities spanning buffer overflows and out-of-bounds writes, lower severity than the rest but still a genuine memory-safety problem.

The networking giant addressed five vulnerabilities in Secure Workload Release 3.10.9.1 for the 3.10 branch and earlier, and 4.0.4.16 for the 4.0 branch.

The company found these vulnerabilities during internal testing; it is not aware of attacks in the wild exploiting this issue.

“The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.” conctinues the advisory. “Cisco says it found the vulnerabilities through internal security testing that also used advanced AI models.”

Nobody’s reported active attacks against any of these nine flaws yet, and Cisco’s own review process caught them before an outside researcher or attacker did.

If your organization runs Crosswork or Secure Workload in any configuration, this isn’t a patch to schedule for next month’s maintenance window. Perfect CVSS scores tend to attract attention fast once a vulnerability’s technical details start circulating, and Cisco’s internal discovery only buys you a head start if you actually use it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco)

Cisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks.

Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware.

The company states that two flaws have public PoCs and could let unauthenticated attackers cause DoS conditions.

“Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations.” reads the advisory.

The flaws, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, affect ClamAV parsers for several file formats. ClamAV fixed them in version 1.5.4, Cisco later warned that public PoCs are available for the vulnerabilities CVE-2026-20337 and CVE-2026-20338. Company’s PSIRT said it has no evidence that attackers have exploited these vulnerabilities in the wild.

“”The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.The Cisco PSIRT is not aware of proof-of-concept exploit code for any of the other vulnerabilities that are described in this advisory.” continues the advisory. “The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.”

Below are the descriptions of CVE-2026-20337 and CVE-2026-20338:

• CVE-2026-20337 (CVSS score of 7.5) – CVE-2026-20337: ClamAV Zip File Format Processing Out-of-Bounds Write Vulnerability – A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
• CVE-2026-20337 (CVSS score of 7.5) – ClamAV Zip File Format Processing Memory Corruption Vulnerability – A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

Cisco identified the affected products in its advisory and recommends customers check the related bug IDs for details on each vulnerability.

Secure Endpoint Private Cloud is not affected, but must distribute the fixes to endpoints.

Cisco said no workaround is available. Patches will be released in August. The flaws are high risk on Windows because ClamAV runs with elevated privileges, while macOS and Linux face medium risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Cisco Secure Firewall Management Center (FMC) flaw to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Firewall Management Center (FMC) flaw, tracked as CVE-2026-20316 (CVSS score of 5.3), to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-20316 is a static credential vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software that could allow an unauthenticated, remote attacker to authenticate using a built-in low-privileged account and access sensitive information stored on the affected system.

“A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.” reads the advisory. “A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.”

The flaw stems from the presence of hardcoded credentials for a low-privileged user account. Although the account provides limited access, it could be combined with other Cisco Secure FMC Software vulnerabilities to achieve privilege escalation. The attack surface is reduced if the FMC management interface is not exposed to the public internet.

Cisco released the following hot fixes to address this issue:

Cisco confirmed active exploitation of the vulnerability in July 2026 and strongly urges customers to upgrade to a fixed software release immediately.

“In July 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” states the advisory.

Administrators can check for exploitation by running cat /var/log/messages | grep license in expert mode. If the logs contain references to /var/tmp/license.tmp, the device may have been compromised. Cisco advises organizations that suspect exploitation to contact TAC for recovery assistance and immediately rotate all user credentials, cryptographic keys, and certificates, as the vulnerability has been actively exploited.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerability by the end of this week, on August 1st, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Hackers exploited Cisco Catalyst SD-WAN flaw CVE-2026-20245 as a zero-day months before disclosure, enabling privileged command execution.

Google-owned Mandiant reported that an unknown threat actor exploited Cisco Catalyst SD-WAN vulnerability CVE-2026-20245 (CVSS base score of 7.8) as a zero-day at least two months before it was publicly disclosed.

The flaw allows an authenticated attacker with netadmin privileges to execute arbitrary commands with elevated rights by using a crafted file. Cisco has confirmed awareness of active exploitation and released fixes.

An authenticated local attacker can trigger the vulnerability to run arbitrary commands as root. The mechanics are straightforward: bad input validation. Although the flaw requires netadmin privileges, attackers can obtain them using stolen credentials or by exploiting previously disclosed vulnerabilities such as CVE-2026-20182 and CVE-2026-20127.

“This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by uploading a crafted file to the affected system. A successful exploit could allow the attacker to perform command injection attacks on an affected system and elevate their privileges as the root user.” reads the advisory. “To exploit this vulnerability, the attacker must have netadmin privileges on the affected system. This would require valid credentials or exploitation of CVE-2026-20182 or CVE-2026-20127. Cisco is not aware of successful exploitation by other methods. Cisco has observed limited cases where the exploitation of this bug resulted in a configuration change pushed to edge devices.”

The vulnerability affects Cisco Catalyst SD-WAN Manager across all deployment models, including on-premises installations, Cisco SD-WAN Cloud-Pro, Cisco-managed cloud deployments, and FedRAMP environments.

“In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access.” reads the report published by Mandiant. “Throughout the intrusion, to maintain operational security and avoid detection, the threat actor consistently employed anti-forensic techniques, selectively deleting and restoring system configuration files that were modified during their activities.”

Mandiant observed attackers targeting a communications service provider in two separate campaigns between late 2025 and March 2026, ultimately escalating a compromised administrator account to full root access.

The first activity likely exploited two then-unknown Cisco SD-WAN authentication bypass flaws, tracked as CVE-2026-20127 and CVE-2026-20182, to establish unauthorized connections. A later intrusion targeted a patched device and may have relied on certificates stolen during an earlier compromise, though investigators have not confirmed whether the same threat actor was responsible for both incidents.

“After establishing an SSH session with the admin account, the threat actor exploited CVE-2026-20245 by executing the following command to upload a file named evil_tenant.csv:

request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0″ continues Mandiant.

“The evil_tenant.csv file contains the exploit payload.”

The exploit enabled attackers to gain elevated privileges and create a rogue “troot” account with full root-level access to the system. The threat actor then accessed this new troot account from the admin account via the su (substitute user) command.

The attackers systematically erased evidence by deleting files, undoing configuration changes, and running cleanup scripts to hinder forensic investigations.

“Mandiant identified that the threat actor deleted all files they created, including evil_tenant.csv, and restored any system configurations they modified. These deletion and modifications were done to minimize their forensic footprint.” continues the report.

According to Google, the case highlights a growing trend of threat actors exploiting zero-day vulnerabilities in edge devices such as SD-WAN systems, which often lack sufficient logging and monitoring capabilities. Compromising these devices can provide long-term access and visibility into an organization’s internal network traffic.

“This campaign underscores the living off the edge paradigm, where threat actors prioritize the compromise of network appliances to bypass traditional security perimeters.” Mandiant concludes. “As organizations increasingly adopt software-defined networking, the orchestrators managing these environments become primary targets.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cisco Catalyst)

Attackers exploit Cisco Unified CM flaw (CVE-2026-20230) allowing unauth HTTP requests to trigger SSRF, write files, and gain root access

Cisco Unified Communications Manager has a serious vulnerability, tracked as CVE-2026-20230 (CVSS score of 8.6), that attackers are already exploiting. The flaw, caused by improper validation of certain HTTP requests, allows a remote attacker without authentication to perform server-side request forgery (SSRF) attacks. Early June, Cisco warned that public PoC code is available and that successful exploitation could allow attackers to write files that may later be used to gain root privileges.

This makes affected systems high risk if exposed. Be careful.

“This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.” reads the advisory. “A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.”

Cisco rated this advisory as Critical instead of High because successful exploitation could allow an attacker to escalate privileges to root. However, the risk depends on configuration: the vulnerability can only be exploited if the WebDialer service is enabled, which is disabled by default on affected systems.

There is no full workaround for this vulnerability. The networking giant recommends mitigating risk by disabling the WebDialer service until a patch is applied. Administrators can do this through the Unified CM Administration interface by going to Unified Serviceability, opening Service Activation under Tools, and unchecking the WebDialer Web Service option in the CTI Services section before saving the changes.

Below are the fixed releases:

The company confirms that PoC exploit code for the vulnerability is publicly available. However, the PSIRT is not aware of attacks in the wild exploiting this issue.

This week, Defused Cyber researchers confirmed it observed active exploitation of the issue in attacks in the wild.

“Over the weekend we observed exploitation of CVE-2026-20230 – Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6)” the researchers wrote on X. “No previously recorded exploitation, and not yet listed in CISA KEV.

This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys. Track Cisco CUCM exploitation”

At this time, Cisco PSIRT has yet to confirm active exploitation of the flaw.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2026-20230)