Cisco Nexus 9000 ACI EPG Contract Bypass Vulnerability (CVE-2026-20038)

Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability Vulnerability Overview Vulnerability ID: cisco-sa-aci-epgcbp-SfDU7NLF CVSS Score: 5.9 (Medium) Publication Date: October 7, 2026 Vulnerability Description: A vulnerability exists in Cisco Nexus 9000 Series Fabric Switches operating in ACI mode that allows an unauthenticated remote attacker to bypass configured EPG (Endpoint Group) contracts. This issue is caused by improper control of EPG contracts. An attacker can exploit this vulnerability by sending IPv4 or IPv6 packets that use UDP source and destination ports allocated for DHCP traffic. Successful exploitation may allow an attacker to bypass EPG contracts on the affected device. Affected Products Affected Products: Cisco Nexus 9000 Series Fabric Switches in ACI Mode Unaffected Products: - Firepower 1000 Series - Firepower 2100 Series - Firepower 4100 Series - Firepower 9300 Security Appliances - MDS 9000 Series Multilayer Switches - Nexus 3000 Series Switches - Nexus 7000 Series Switches - Nexus 9000 Series Switches in standalone NX-OS mode - Secure Firewall 200 Series - Secure Firewall 1200 Series - Secure Firewall 3100 Series - Secure Firewall 4200 Series - Secure Firewall 6100 Series - UCS 6300 Series Fabric Interconnects - UCS 6400 Series Fabric Interconnects - UCS 6500 Series Fabric Interconnects - UCS 6600 Series Fabric Interconnects - UCS X-Series Direct Fabric Interconnect 9108 100G Remediation Software Update: Cisco has released software updates to address this vulnerability. Configuration Adjustment: The following steps are required to remediate this vulnerability: 1. Upgrade Cisco APIC to version 6.0(9h), 6.1(6g), 6.2(3g), or later. 2. Upgrade Cisco Nexus 9000 Series Fabric Switches in ACI Mode to version 16.0(9h), 16.1(6g), 16.2(3g), or later. 3. Apply configuration knobs to disable or re-enable DHCP implicit rules; refer to the Cisco APIC Basic Configuration Guide, Release 6.2(x) for details. Additional Information Workarounds: None Cisco Bug ID: CSCwh19270 CVE Number: CVE-2026-20038 CWE Number: CWE-284

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Nexus 9000 ACI EPG Contract Bypass Vulnerability (CVE-2026-20038)

More from this source