Riskcovery

CVE-2026-20033

Cisco NX-OS Software Denial of Service Vulnerability

State
Published
Severity
7.4 High
Published
Feb 25, 2026
Updated
Feb 25, 2026
Reserved
Oct 8, 2025

Read the record on cve.org

Description

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability is due to insufficient validation when processing specific Ethernet frames. An attacker could exploit this vulnerability by sending a crafted Ethernet frame to the management interface of an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. Note: Only the out-of-band (OOB) management interface is affected.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hcisco

Weaknesses

  • CWE-805 Buffer Access with Incorrect Length Value

Affected Products

ProductVersions
Cisco NX-OS System Software in ACI ModeCisco
  • 15.2(1g)Affected
  • 15.2(2e)Affected
  • 15.2(2f)Affected
  • 15.2(2g)Affected
  • 15.2(2h)Affected
  • 15.2(3f)Affected
  • 15.2(3e)Affected
  • 15.2(3g)Affected
  • 15.2(4d)Affected
  • 15.2(4e)Affected
  • 15.2(5c)Affected
  • 15.2(5d)Affected
  • 16.0(1g)Affected
  • 15.2(5e)Affected
  • 15.2(4f)Affected
  • 15.2(6e)Affected
  • 15.2(6h)Affected
  • 16.0(1j)Affected
  • 15.2(6g)Affected
  • 15.2(7f)Affected
  • 15.2(7g)Affected
  • 16.0(2h)Affected
  • 15.2(8d)Affected
  • 16.0(2j)Affected
  • 15.2(8e)Affected
  • and 32 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.