CVE-2026-20361

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.18.8High EPSS percentile18th0.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 0 sources FixNone yetNo fix or workaround published

Published 2026-09-16Updated 2026-09-18Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Confirm whether your organization runs Cisco Nexus Dashboard and record its installed version.
Restrict dashboard access to trusted administrator networks and review all accounts with dashboard access while a fix is unavailable.
Check Cisco’s security advisories for CVE-2026-20361 daily; no fixed version has been published.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.

In plain language

Written by AI from the record

Cisco Nexus Dashboard has a serious flaw with a public exploit available; businesses using it should treat this as urgent, although Cisco has not published a fix yet.

CVE-2026-20361 is an authenticated, network-reachable SQL injection vulnerability in Cisco Nexus Dashboard that can compromise confidentiality, integrity, and availability.

If you're affected

Dashboard takeover
Network operations disruption
Configuration tampering
Sensitive data exposure

What is it

This is a weakness in the dashboard’s handling of information sent to its database. It is like allowing someone with a building badge to alter the instructions sent to the building’s control room, potentially giving them control over important systems or stopping normal operations.

Who is affected

This matters to you if you run Cisco Nexus Dashboard to manage or monitor network infrastructure. The vulnerability requires an attacker to already have a valid login and be able to reach the dashboard over the network.

How urgent is it

A public exploit is available, making this a red-priority issue for organizations using the product. Act now to limit dashboard access and protect administrator accounts while waiting for Cisco to publish a fix.

What to do — in detail

Identify all Cisco Nexus Dashboard deployments, their installed releases, and every network path that can reach their management interface.
Treat all valid dashboard accounts as sensitive: remove inactive accounts, rotate credentials where appropriate, require strong multi-factor authentication where supported, and limit access to approved administrator networks.
Cisco has not published fixed versions or an upgrade path for CVE-2026-20361. Track Cisco’s advisory and apply the vendor-provided fixed release as soon as it becomes available; do not assume an arbitrary newer release resolves this CVE.
If patching is delayed, place the management interface behind a VPN or restricted management network, allow only required administrator source addresses, and block unnecessary access paths.
Review dashboard and identity-provider logs for unusual authenticated activity, unexpected database-related errors, new privileged accounts, configuration changes, or management actions from unfamiliar locations. CISA KEV does not list this CVE, so there is no CISA remediation due date.

Technical context

CVE-2026-20361 is rated CVSS 8.8 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-89 SQL injection: an authenticated attacker with network access may manipulate database queries, with high potential impact to confidentiality, integrity, and availability. A public exploit is available. It is not listed in CISA KEV, and there is no finding confirming exploitation in the wild. EPSS predicts 0.3% likelihood (21th percentile) with a flat trend; this is predictive rather than evidence of active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS18th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 18th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 2 days, from the signal feeds we watch.

2026-09-18Record updated
2026-09-17Record updated
2026-09-16Publishedweakness classified, att&ck mapped, record updated

Affected products

Ciscocommercial · USaka cisco systems inc., cisco systems
- Cisco Nexus DashboardNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 8.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable