Cisco Nexus 9000 Series Silicon One S1HAL unauthenticated root RCE (CVSS 9.8)

cve · CVE-2026-20212 single-source

Coverage

first 2026-09-04 → last 2026-10-11

Latest activity

2026-09-04

Cisco patches an unauthenticated path to root code execution on Nexus 9000 switches carrying a Silicon One…

Peak priority

high

1 high

Targets

public-sector

sectors: public-sector

Sources cited

3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-20212, newest first. Check the date before acting on an older one.

Run show module on every Nexus 9000 switch to identify units carrying a Silicon One ASIC (PIDs N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O/Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804/9808); upgrade those to a fixed NX-OS release via Cisco's Software Checker, and until upgraded, deploy an infrastructure ACL denying TCP destined to ports 43210/43211 or Cisco's Live Protect shield for CVE-2026-20212.
2026-09-04CVE-2026-20212

Defender insights

What each entry about CVE-2026-20212 tells a defender to do, newest first.

2026-09-04HIGHCisco patches an unauthenticated path to root code execution on Nexus 9000 switches carrying a Silicon One ASIC

Detection

Story timeline

ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-04/cve-2026-20212-cisco-nexus-9000-s1hal-unauth-root-rce · ATT&CK page ↗

Entries about Cisco Nexus 9000 Series Silicon One S1HAL unauthenticated root RCE (CVSS 9.8) (1)

2026-09-04 · view entry permalink →

HIGHCVE-2026-20212updatedNATOA2

CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211

Cisco published cisco-sa-n9k-s1-rce-EH8dEtr on 2026-09-02, disclosing CVE-2026-20212 (CVSS 9.8, CWE-1327 Binding to an Unrestricted IP Address) in the Silicon One ASIC integration on Nexus 9000 Series switches. TCP ports 43210 and 43211, used by the S1HAL (Silicon One Hardware Abstraction Layer) process, are reachable in the default Layer 3 VRF; an unauthenticated remote attacker who can reach either port sends crafted input that executes as root, or crashes the S1HAL process, which could cause the device to reload (Cisco PSIRT, 2026-09-02). Only switches carrying a Silicon One ASIC are affected. Cisco names ten specific product IDs, determinable via show module, and the advisory's own "Products Confirmed Not Vulnerable" section explicitly excludes the Nexus 3000 Series and every other Nexus 9000 model, so inventory should key on the ten Silicon One product IDs rather than on the Nexus 9000 family name, as Cisco's own advisory title "Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability" might suggest (Cisco PSIRT, 2026-09-02). Cisco also lists Nexus 9000 Series Fabric Switches in ACI mode as not vulnerable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a Technical Assistance Center (TAC) support case and states it is not aware of any public announcement or malicious use (Cisco PSIRT, 2026-09-02).

Fixed NX-OS software is available via Cisco's Software Checker. Until upgraded, Cisco's workaround is infrastructure ACLs (iACLs) that allow only required management and control-plane traffic to the device, or that deny all TCP packets to a locally configured address on ports 43210 or 43211. Cisco also offers a temporary NX-OS Live Protect shield for this CVE and treats every workaround as a bridge to the fixed release, not a substitute (Cisco PSIRT, 2026-09-02).

This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and send crafted input that could be executed as code with root privileges.

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

Cisco PSIRT 2026-09-02

Correction30 Sep 2026 07:19 UTCrun 2026-09-30T0639Z-auditsourcessourcing_notebodysummary

Hunt for connections to TCP ports 43210 and 43211 on the switches' addresses in the default Layer 3 VRF, where Cisco says the ports are reachable (Cisco PSIRT, 2026-09-02). Cisco found the flaw while resolving a TAC support case, and the advisory does not describe the case as internal (Cisco PSIRT, 2026-09-02).

Correction11 Oct 2026 14:02 UTCrun 2026-10-11T1307Z-auditbodysummary

Cisco says a crash of the S1HAL process could cause the device to reload; the analysis had said the flaw forces a reload or crashes the device. Cisco also lists Nexus 9000 Series Fabric Switches in ACI mode as not vulnerable (Cisco PSIRT, 2026-09-02).

vulnerability04 Sep 05:10Zsingle-sourceOpen finding →

Sources: Cisco PSIRT · NCSC-NL · CERT-FR / ANSSI

Cisco Nexus 9000 Series Silicon One S1HAL unauthenticated root RCE (CVSS 9.8)

Action items (1)

Defender insights

Story timeline

Hunting pivots

Initial Access TA0001

Entries about Cisco Nexus 9000 Series Silicon One S1HAL unauthenticated root RCE (CVSS 9.8) (1)

CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/43211

Co-occurring entities

Where this entity is cited

Source distribution

External references