CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20038
Advisory Summary
⬛ Cisco Nexus 9000 (ACI Mode) – EPG Contract Bypass Vulnerability (CVE-2026-20038)
⚠️ What’s happening
A vulnerability affects the endpoint group (EPG) contract functionality on Cisco Nexus 9000 Series Fabric Switches when running in ACI Mode. It could allow an unauthenticated, remote attacker to bypass configured EPG contracts, undermining segmentation and intended traffic restrictions.
🧩 How the exploit works (key technical condition)
The issue stems from an improper control involving EPG contracts. An attacker may send IPv4 or IPv6 UDP traffic with source/destination ports assigned to DHCP traffic through the affected device. If successful, this may enable contract bypass on the switch.
- Impact rating: Medium
- Primary risk: Segmentation control bypass → possible unauthorized east-west communication paths within the ACI fabric.
- ✅ Software updates are available and address the vulnerability.
- 🚫 No workarounds are provided.
- Inventory quickly: Identify Nexus 9000 switches operating in ACI Mode and confirm the current NX-OS/ACI-related software levels.
- Patch without delay: Plan deployment of the Cisco-provided fixed releases for the affected platform/software train.
- Risk validation: Prioritize environments where:
- DHCP-related UDP flows traverse the fabric
- Strict EPG contract segmentation is relied upon for tenant isolation
- Monitoring: After patching, validate ACI policy enforcement for EPG contract behavior, especially around any DHCP-forwarding/related traffic patterns.
🔗
-2026-20038
Reference: Vendor Advisory