CVE-2026-20212: Critical Cisco Nexus 9000 Flaw Enables Unauthenticated Root RCE

Cisco disclosed CVE-2026-20212, a critical (CVSS 9.8) remote code execution vulnerability in selected Nexus 9000 switches with Silicon One ASICs that expose TCP ports 43210 and 43211 via the default Layer 3 VRF; an unauthenticated attacker who can reach those ports may execute code with root privileges or crash the S1HAL process causing device reloads. Cisco lists affected PIDs and NX-OS releases, recommends using the Software Checker to identify fixed releases, and provides mitigations including immediate upgrades, iACLs to block the ports, and Live Protect shield lp00031, while advising monitoring of connections to the ports, Live Protect hits, S1HAL instability, and unexpected configuration changes.