Cisco patches critical Nexus 9000 bug that lets attackers run code as root

Key points

• Cisco has patched a critical flaw, tracked as CVE-2026-20212, in 10 of its Silicon One-based Nexus 9000 data centre switches.
• The bug scores 9.8 out of 10 on the industry severity scale and lets a remote attacker run commands as the top-level "root" user without logging in.
• A separate IOS XR hardening release fixes seven CVEs at once, two of them also rated 9.8, and Cisco says there is no workaround for any affected IOS XR version.
• Customers running the affected switches or routers need to install the updates; no configuration change blunts the risk.

Cisco has shipped fixes for a critical vulnerability in its Nexus 9000 switches, the kind of hardware that quietly runs the networks inside hospitals and cloud data centres. If exploited, the bug hands a remote attacker complete control of the device without needing a password.

The flaw is tracked as CVE-2026-20212 and carries a severity score of 9.8 out of 10. That score is reserved for bugs that are easy to exploit over the network and give attackers the keys to the whole machine. This is Cisco's third patch cycle we've reported on since early August, following four maximum-severity flaws in Crosswork Network Software on 20 August.

At the same time, Cisco released a hardening update for its IOS XR software, the operating system that powers many of its carrier-grade routers. That single release rolls up seven separate CVEs (Common Vulnerabilities and Exposures, the industry's numbering system for security bugs), and two of them also score 9.8. Because no workaround exists for any affected IOS XR version, patching is the only option.

The reporting was first surfaced by The Hacker News.

What is actually vulnerable?

The Nexus bug affects 10 models in Cisco's Silicon One-based Nexus 9000 line, high-end switches used to move traffic inside data centres. An attacker who can reach the switch over the network can send a crafted request and run code as "root", the most privileged account on the device.

Root access lets an attacker read or redirect traffic and use the switch as a quiet foothold into the servers behind it. For a hospital or a bank, that means the machine carrying every internal connection is under someone else's control.

The IOS XR bundle packages seven bugs into one hardening release so administrators fix them in a single maintenance window.

Is this being exploited yet?

Cisco hasn't said the bugs are being used in live attacks. That distinction matters. A 9.8 score describes capability, what an attacker could do with a working exploit, not confirmed activity.

Critical Cisco flaws tend to draw fast attention from security researchers and, on a longer tail, from state-linked intrusion crews. Groups that historically prospect edge network gear, including clusters Cisco Talos tracks under names like Static Tundra, have held on to router and switch access for months at a stretch. That's a pattern worth noting, not an attribution for this bug.

What should network teams do now?

Install the fixed software. For Nexus 9000 switches, apply the release Cisco has flagged for CVE-2026-20212. For IOS XR, apply the hardening release covering the seven CVEs. Access lists won't substitute for the patch.

Treat this window as urgent rather than routine. Check switch logs for unfamiliar administrative sessions before and after the update, in case someone was already inside.

The broader pattern is worth watching: four Cisco patch rounds in roughly five weeks, several of them touching gear that sits at the boundary of enterprise networks. Whether that tempo reflects a coordinated internal audit or external pressure from researchers isn't clear yet.