Denial of Service Risk in Cisco Nexus Switches Due to BGP Parsing Issue

CVE-2026-20171

What is CVE-2026-20171?

A critical flaw exists in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 and 9000 Series Switches running in standalone NX-OS mode. This issue arises from improper parsing of a transitive BGP attribute, which could be exploited by an unauthenticated remote attacker. By sending a specially crafted BGP update through an established BGP peer session, the attacker could cause the affected device to drop its BGP session and repeatedly flap with the peer, leading to a significant denial of service (DoS) condition. Addressing this vulnerability is crucial for maintaining the integrity and availability of network operations.

References