A flaw in the endpoint group contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode permits an unauthenticated remote attacker to bypass configured EPG contracts. By sending IPv4 or IPv6 UDP packets that use source and destination ports assigned to DHCP traffic through an affected device, the attacker can cause the switch to treat the packets as if they are covered by the contract and forward them to endpoints that would normally be denied. The result is that traffic that should be blocked or inspected can traverse the fabric, potentially exposing sensitive internal resources and compromising network segmentation.

Cisco Nexus 9000 Series Fabric Switches running NX‑OS System Software in ACI Mode are vulnerable. No specific firmware revisions are listed in the advisory, so all versions that have the unpatched endpoint group contract code should be considered affected until a patch is applied.

The CVSS score of 5.8 places the vulnerability in the medium range, indicating that while the flaw is not trivial, it poses a tangible risk. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Attack vectors are remote and require an attacker to be able to inject crafted UDP packets into the network. Because the issue only affects packets on specific ports, an attacker could attempt to discover or guess those ports to bypass the contract, but no publicly known automated exploitation tools exist at this time.