CVE-2026-20322

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.19.9Critical EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether your organization runs Cisco Nexus Dashboard and identify every version in use.
Review user accounts and remove or disable any that are no longer needed.
No fixed version has been published; ask Cisco or your support provider for the security-hardening release that addresses CVE-2026-20322.
Restrict dashboard access to trusted administrators and management networks until an update is available.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20322 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.

In plain language

Written by AI from the record

Cisco Nexus Dashboard has a critical access-control flaw affecting logged-in users; typical small businesses should act promptly if they run it.

Improper access control in Cisco Nexus Dashboard allows a low-privileged authenticated attacker over the network to compromise confidentiality, integrity, and availability.

If you're affected

Unauthorized dashboard changes
Network operations disruption
Sensitive configuration exposure
Loss of management access

What is it

This is a flaw in the rules that control what a signed-in person is allowed to do in Cisco Nexus Dashboard. It is like giving a staff member a building badge that unexpectedly opens rooms they should not be able to enter, letting them interfere with important network-management work.

Who is affected

This matters to you if you use or run Cisco Nexus Dashboard to manage network infrastructure. It is a risk only if an attacker already has a valid login and can reach the dashboard over the network.

How urgent is it

A public exploit is available, meaning attackers have a ready-made way to try to abuse this weakness. Treat this as urgent: review access immediately and obtain Cisco’s remediation guidance because the issue can affect the dashboard’s data, settings, and availability.

What to do — in detail

Inventory all Cisco Nexus Dashboard deployments, their installed versions, and every network path that can reach their management interfaces.
Confirm which accounts have access, especially low-privileged, shared, contractor, and service accounts; disable unneeded accounts and investigate unexpected recent account activity.
Cisco has not published a fixed version in the available findings. Obtain Cisco’s advisory or support guidance for CVE-2026-20322 before scheduling an upgrade, and validate the recommended security-hardening release in a maintenance window.
Until a vendor fix is available, limit management-interface access to approved administrator networks, remove unnecessary remote access paths, and enforce least-privilege roles.
Monitor dashboard audit records, account changes, configuration changes, and failed or unusual login activity for unauthorized access attempts. This CVE is not listed in CISA KEV, so no CISA remediation due date is available.

Technical context

CVE-2026-20322 is rated CVSS 9.9 Critical (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). It is CWE-284 improper access control, remotely reachable with low privileges and no user interaction; the scope-change and high confidentiality, integrity, and availability impacts indicate potential control beyond the initially authorized boundary. A public exploit is available, indicating weaponization, although CISA KEV does not list this CVE and the findings do not confirm exploitation in the wild. EPSS is 0.3% (20th percentile) with a flat trend; this is predictive only. No patch or fixed-version information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 2 days, from the signal feeds we watch.

2026-09-18Record updatedrecord updated
2026-09-16Publishedweakness classified, record updated

Affected products

Ciscocommercial · USaka cisco systems, cisco systems inc.
- Cisco Nexus DashboardNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Scored 9.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable