Cisco Nexus 9000 ACI Mode EPG contract bypass flaw (CVE-2026-20038) allows unauthenticated remote traffic filtering evasion
Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗
Cisco disclosed CVE-2026-20038, a medium-severity vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode. An unauthenticated, remote attacker could bypass configured EPG contracts, undermining segmentation policy enforced by the fabric. The flaw stems from improper control with EPG contracts. Cisco has released software updates, and no workarounds exist. The article does not report exploitation in the wild. The advisory is part of Cisco's October 7, 2026 bundled publication and the NX-OS Software Security Hardening Release for October 2026.
Technical Details
An attacker can exploit the flaw by sending IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic through an affected device. Successful exploitation lets the attacker bypass EPG contracts on the device. Cisco rates the Security Impact as Medium.
Remediation
Apply the Cisco software updates that address the vulnerability, as no workarounds are available. Consult the Cisco advisory cisco-sa-aci-epgcbp-SfDU7NLf for fixed release details.
Linha do tempo
-
sec.cloudapps.cisco.com ↗ · pub. 07/10/2026 13:00 · coletado 19/10 18:01 primeiro registro só resumo do feed
Cisco Nexus 9000 ACI Mode EPG contract bypass flaw (CVE-2026-20038) allows unauthenticated remote traffic filtering evasion
ler a análise desta fonte ocultar
Cisco disclosed CVE-2026-20038, a medium-severity vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode. An unauthenticated, remote attacker could bypass configured EPG contracts, undermining segmentation policy enforced by the fabric. The flaw stems from improper control with EPG contracts. Cisco has released software updates, and no workarounds exist. The article does not report exploitation in the wild. The advisory is part of Cisco's October 7, 2026 bundled publication and the NX-OS Software Security Hardening Release for October 2026.
Technical Details
An attacker can exploit the flaw by sending IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic through an affected device. Successful exploitation lets the attacker bypass EPG contracts on the device. Cisco rates the Security Impact as Medium.
Remediation
Apply the Cisco software updates that address the vulnerability, as no workarounds are available. Consult the Cisco advisory cisco-sa-aci-epgcbp-SfDU7NLf for fixed release details.