Cisco has released emergency patches for a critical remote code execution flaw in its Nexus 9000 series switches that run on Silicon One chips. Tracked as CVE-2026-20212 (CVSS 9.8), the vulnerability stems from a daemon binding to an unrestricted IP address, which leaves TCP ports 43210 and 43211 reachable from the network in the default Layer 3 virtual routing and forwarding (VRF) configuration. An unauthenticated attacker who can reach the switch on either of those ports can send crafted packets to trigger code execution with root privileges — or crash the S1HAL process and force a device reload. Cisco disclosed the flaw on September 2 and says it is not aware of any active exploitation to date.
The same disclosure batch includes an IOS XR hardening release grouping seven CVEs into umbrella advisories, two of which carry a 9.8 ceiling: CVE-2026-20274, covering memory-safety and resource-lifetime bugs, and CVE-2026-20279, covering access-control flaws including missing authentication for critical functions. All 111 affected IOS XR releases require software maintenance units (SMUs) before a full fix is available; future releases 26.2.2 and 26.3.1 will be the first to ship already fixed. The development follows Sygnia’s disclosure last week that a China-nexus group called Fire Ant had been planting purpose-built implants on IOS XR routers at critical infrastructure targets, suppressing logs and hiding routing changes.
How to check if you’re affected
Affected products are Nexus 9000 switches with Silicon One chips running NX-OS versions 10.3(1) through 10.6(3s). Run the show module command on your switch and compare the device PIDs against Cisco’s security advisory to confirm exposure. As a temporary mitigation, Cisco recommends deploying an infrastructure access control list (iACL) to block inbound traffic to TCP ports 43210 and 43211 until a fixed software release can be applied. For IOS XR, check the Cisco advisory for your release branch’s SMU availability.