Cisco ACI network segmentation vulnerability: remediation requires both version and configuration updates
CVE-2026-20038 affects Nexus 9000 switches in ACI mode and may allow some traffic to bypass endpoint group policies.
Source Facts
On 7 October, Cisco disclosed a medium-severity vulnerability that may let an unauthenticated remote attacker bypass ACI endpoint group contracts. Cisco confirms that Nexus 9000 switches running standalone NX-OS mode are not affected.
Remediation requires updating APIC and switch software and applying new settings specified in official guidance; a version upgrade alone is incomplete. At publication, Cisco was unaware of malicious exploitation, and no workaround could replace the fix.
Confirm the equipment's operating mode first, then verify that patched versions and network policies are in effect.
Original sources
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration