CVE-2026-20212 is a critical remote code execution vulnerability in the Silicon One ASIC integration used by certain Cisco Nexus 9000 Series Switches - high-performance data centre switching platforms. TCP ports 43210 and 43211, used by the Silicon One Hardware Abstraction Layer (S1HAL) process, are accessible in the default Layer 3 VRF (Virtual Routing and Forwarding instance). An unauthenticated, remote attacker who can reach these ports can send crafted input that is executed with root privileges on the device, or that crashes the S1HAL process and triggers a device reload. This vulnerability was found internally by Cisco during the resolution of a Cisco Technical Assistance Center (TAC) support case, not reported by an external researcher.

The following version(s) are affected:

Cisco Nexus 9000 Series Switches equipped with a Silicon One ASIC, including models N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808 – (Affected)

Cisco's advisory does not publish a single fixed-release table; instead, it directs customers to Cisco's own Software Checker tool to identify the correct fixed NX-OS release for their specific platform and current version. Nexus 9000 switches that do not include a Silicon One ASIC (the majority of the Nexus 9000 line) are not affected by this specific CVE.

Typical attack flow:

1. Reach TCP port 43210 or 43211 on an affected switch — An unauthenticated attacker with network access to an affected Nexus 9000 switch's default Layer 3 VRF connects to TCP port 43210 or 43211, both used by the Silicon One Hardware Abstraction Layer (S1HAL) process and reachable without any access restriction by default.
2. Send crafted input to execute code as root, or crash the S1HAL process — The attacker sends crafted input to the exposed port, which the S1HAL process executes with root privileges — or, alternatively, the crafted input crashes the S1HAL process, triggering a reload of the switch and a denial-of-service condition.

CERTVU recommends the following:

1. Apply the Workaround Immediately, Then Upgrade

   Use infrastructure access control lists (iACLs) to allow only required management and control-plane traffic to the device, or to explicitly deny TCP packets destined to a locally-configured IP address on port 43210 or 43211 (per Cisco's own published workaround). Cisco has also released a "Live Protect shield" for CVE-2026-20212 as a temporary mitigation. Use Cisco's Software Checker tool to identify and apply the correct fixed NX-OS release for your platform as the permanent remediation.

2. Prioritize This Workaround and Patch on Every Affected Switch

   Prioritize this workaround and patch on every affected switch, since unauthenticated root-level code execution is the most severe practical outcome a network device vulnerability can have.

3. Audit the Estate for Affected Nexus 9000 Hardware

   Audit the estate for affected Nexus 9000 hardware.

4. Treat Unmitigated Switches as Potentially Compromised

   Treat any internet-reachable, unmitigated switch as potentially compromised.

5. Review Device Stability and Configuration

   Review device stability and configuration.

Report suspected compromise to CERTVU at This email address is being protected from spambots. You need JavaScript enabled to view it. or on telephone (678) 33380.