Critical Cisco Nexus 9000 Flaw Lets Remote Attackers Execute Code as Root Without Authentication

Cisco published a security advisory for CVE-2026-20212, a critical (CVSS 9.8) remote code execution flaw in Nexus 9000 Series switches with Silicon One ASICs that is reachable via TCP ports 43210 and 43211; successful exploitation can yield root code execution and may also crash the S1HAL process causing reboots/DoS. Cisco lists specific affected models, recommends upgrading to fixed NX-OS releases, using iACLs to block the ports as an interim measure and deploying a Live Protect shield; no known public exploitation was reported as of the advisory.