Patch Now: Cisco Zero-Day Under Fire From Chinese APT

Cisco patched a command-line injection flaw (CVE-2024-20399, CVSS 6.0) in NX-OS that allows authenticated admin users to execute arbitrary root commands; Sygnia reports the China-backed APT Velvet Ant has actively exploited the bug to jailbreak the NX-OS CLI, deploy custom malware to compromised Nexus switches, and maintain persistence as part of a broader multiyear campaign—organizations are advised to apply Cisco updates, restrict admin access, enforce MFA/PAM, limit outbound connections from switches, and follow strong patch and password hygiene.