CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-20173
Advisory Summary
🗓️ 📅 October 7, 2026
⬛ 🔔 Cisco NX-OS Control Plane DoS — Unauthenticated Remote Resource Exhaustion
⚠️ What happened
Cisco disclosed a Medium-severity vulnerability in Cisco NX-OS Software that could let an unauthenticated remote attacker trigger a Denial of Service (DoS) by exhausting system resources.
- Root cause: Improper rate limiting for certain protocols.
- Method: An attacker can send a high rate of UDP or TCP connections to an affected device’s data plane interface.
- Impact: The resulting packet loss and temporary disruptions can destabilize routing and control plane protocols, producing a DoS condition.
- Recovery behavior: The DoS clears automatically shortly after the high-rate traffic stops (no manual intervention required).
- CVE-2026-20173
🛠️ Fix / Security updates
✅ Cisco has released software updates to address the issue.
🚫 Workarounds
❌ No workarounds are provided.
- DoS risk is most acute in environments where NX-OS devices are exposed to untrusted traffic sources (e.g., misconfigured ACLs, open reachability, or insufficient edge filtering).
- Because the failure clears after the burst ends, real-world impact may show up as intermittent routing/control-plane instability, which can still be operationally severe during outages, failovers, or incident windows.
✅ Recommended immediate actions
1. Identify affected NX-OS versions using Cisco’s advisory and inventory all impacted switches.
2. Plan and deploy the patched software in the next maintenance window (or immediately for internet-facing / high-availability cores).
3. Add/verify edge rate controls and traffic filtering so UDP/TCP connection bursts cannot reach data plane interfaces from untrusted networks.
4. Monitor for symptoms: control-plane instability, routing flaps, packet loss bursts, and interface/session spikes aligned with the exploit pattern.
🔗
-OS -2026-20173
Reference: Vendor Advisory