Cisco addresses critical vulnerabilities in Nexus 9000 switches and IOS XR

Cisco has released patches to address a critical security flaw affecting its Silicon One-based Nexus 9000 switches, which could allow remote code execution as root. This release also includes an IOS XR hardening update that bundles seven vulnerabilities, two of which have a CVSS score of 9.8, according to a recent report by The Hacker News.

The critical Nexus vulnerability (CVE-2026-20212) allows unauthenticated attackers to execute code with root privileges by binding to an unrestricted IP address and reaching TCP ports 43210 and 43211. Exploitation can also lead to a device reload. Cisco is not aware of any malicious use of this flaw but recommends customers upgrade to fixed releases or apply temporary mitigations like an infrastructure access control list (iACL).

Separately, Cisco has released an IOS XR hardening update addressing seven vulnerabilities, with two rated 9.8. These affect all IOS XR releases, and Cisco is providing software maintenance updates (SMUs) for various versions, with fixed releases expected soon. The company is also addressing separate S/MIME decryption flaws in Secure Email and a denial-of-service bug in its desk phones. These updates come after reports of a China-linked threat actor, Fire Ant, exploiting IOS XR routers for malicious purposes.

Source: The Hacker News