CVE-2026-20051 - Vulnerability Details

- Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability

Description

A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Platforms could allow an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop.

This vulnerability is due to a logic error when processing a crafted Layer 2 ingress frame. An attacker could exploit this vulnerability by sending a stream of crafted Ethernet frames through the targeted device. A successful exploit could allow the attacker to cause a Layer 2 Virtual eXtensible LAN (VxLAN) traffic loop, which, in turn, could result in a denial of service (DoS) condition. This Layer 2 loop could oversubscribe the bandwidth on network interfaces, which would result in all data plane traffic being dropped. To exploit this vulnerability, the attacker must be Layer 2-adjacent to the affected device.
Note: To stop active exploitation of this vulnerability, manual intervention is required to both stop the crafted traffic and flap all involved network interfaces. For additional assistance if a Layer 2 loop that is related to this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or the proper support provider. 

Published: 2026-02-25

Score: 7.4 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A logic error in the Ethernet VPN (EVPN) Layer 2 ingress processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500‑R Series Switching Platforms allows an unauthenticated, Layer 2‑adjacent attacker to send a stream of crafted Ethernet frames that triggers a Layer 2 Virtual eXtensible LAN (VxLAN) traffic loop. The loop can oversubscribe network interface bandwidth, causing all data‑plane traffic to be dropped and resulting in a denial of service.

Affected Systems

The vulnerability affects Cisco Nexus 3600 and Cisco Nexus 9500‑R series switches running Cisco NX‑OS Software. No specific OS version range is supplied in the advisory, so any deployed NX‑OS firmware on these platforms should be examined for the fix.

Risk and Exploitability

With a CVSS score of 7.4 the vulnerability is classified as high severity. The EPSS score is below 1%, indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. However, the attack requires direct Layer 2 adjacency and the potential to disrupt all traffic on the device makes it a significant risk for affected networks. Exploitation would require the attacker to transmit crafted Ethernet frames; once activated, manual intervention to stop the traffic and flap interfaces is necessary to restore normal operation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco NX-OS Software

unknown

Version	Status	Constraints
`9.2(3)`	affected	—
`9.2(2v)`	affected	—
`9.2(1)`	affected	—
`9.2(2t)`	affected	—
`9.2(3y)`	affected	—
`9.3(2)`	affected	—
`9.2(4)`	affected	—
`9.3(1)`	affected	—
`9.3(1z)`	affected	—
`9.2(2)`	affected	—
`9.3(3)`	affected	—
`9.3(4)`	affected	—
`9.3(5)`	affected	—
`9.3(6)`	affected	—
`9.3(5w)`	affected	—
`9.3(7)`	affected	—
`9.3(7k)`	affected	—
`10.2(1)`	affected	—
`9.3(7a)`	affected	—
`9.3(8)`	affected	—
`10.2(1q)`	affected	—
`10.2(2)`	affected	—
`9.3(9)`	affected	—
`10.2(3)`	affected	—
`10.2(3t)`	affected	—
`9.3(10)`	affected	—
`10.2(2a)`	affected	—
`10.3(1)`	affected	—
`10.2(4)`	affected	—
`10.3(2)`	affected	—
`9.3(11)`	affected	—
`10.3(3)`	affected	—
`10.2(5)`	affected	—
`9.3(12)`	affected	—
`10.2(3v)`	affected	—
`10.4(1)`	affected	—
`10.2(6)`	affected	—
`10.3(3w)`	affected	—
`10.3(3o)`	affected	—
`10.3(4)`	affected	—
`10.3(3p)`	affected	—
`10.3(4a)`	affected	—
`10.4(2)`	affected	—
`10.3(3q)`	affected	—
`9.3(13)`	affected	—
`10.3(5)`	affected	—
`10.2(7)`	affected	—
`10.4(3)`	affected	—
`10.3(3x)`	affected	—
`10.3(4g)`	affected	—
`10.5(1)`	affected	—
`10.2(8)`	affected	—
`10.3(3r)`	affected	—
`10.3(6)`	affected	—
`9.3(14)`	affected	—
`10.4(4)`	affected	—
`10.3(4h)`	affected	—
`10.5(2)`	affected	—
`10.3(7)`	affected	—
`10.4(5)`	affected	—
`10.5(3)`	affected	—
`10.2(9)`	affected	—
`9.3(15)`	affected	—
`10.4(4g)`	affected	—
`10.5(4)`	affected	—
`10.6(1)`	affected	—
`10.5(3t)`	affected	—
`10.3(8)`	affected	—
`10.4(6)`	affected	—
`10.5(3s)`	affected	—
`10.5(3e)`	affected	—
`10.5(3o)`	affected	—
`9.3(16)`	affected	—
`10.6(1s)`	affected	—
`10.5(3p)`	affected	—

No data.

Vendor Product Confidence Versions

Cisco

Nx-os Software

100%

Version	Status	Scheme	Platform
`9.2(3)`	affected	generic	—
`9.2(2v)`	affected	generic	—
`9.2(1)`	affected	generic	—
`9.2(2t)`	affected	generic	—
`9.2(3y)`	affected	generic	—
`9.3(2)`	affected	generic	—
`9.2(4)`	affected	generic	—
`9.3(1)`	affected	generic	—
`9.3(1z)`	affected	generic	—
`9.2(2)`	affected	generic	—
`9.3(3)`	affected	generic	—
`9.3(4)`	affected	generic	—
`9.3(5)`	affected	generic	—
`9.3(6)`	affected	generic	—
`9.3(5w)`	affected	generic	—
`9.3(7)`	affected	generic	—
`9.3(7k)`	affected	generic	—
`10.2(1)`	affected	generic	—
`9.3(7a)`	affected	generic	—
`9.3(8)`	affected	generic	—
`10.2(1q)`	affected	generic	—
`10.2(2)`	affected	generic	—
`9.3(9)`	affected	generic	—
`10.2(3)`	affected	generic	—
`10.2(3t)`	affected	generic	—
`9.3(10)`	affected	generic	—
`10.2(2a)`	affected	generic	—
`10.3(1)`	affected	generic	—
`10.2(4)`	affected	generic	—
`10.3(2)`	affected	generic	—
`9.3(11)`	affected	generic	—
`10.3(3)`	affected	generic	—
`10.2(5)`	affected	generic	—
`9.3(12)`	affected	generic	—
`10.2(3v)`	affected	generic	—
`10.4(1)`	affected	generic	—
`10.2(6)`	affected	generic	—
`10.3(3w)`	affected	generic	—
`10.3(3o)`	affected	generic	—
`10.3(4)`	affected	generic	—
`10.3(3p)`	affected	generic	—
`10.3(4a)`	affected	generic	—
`10.4(2)`	affected	generic	—
`10.3(3q)`	affected	generic	—
`9.3(13)`	affected	generic	—
`10.3(5)`	affected	generic	—
`10.2(7)`	affected	generic	—
`10.4(3)`	affected	generic	—
`10.3(3x)`	affected	generic	—
`10.3(4g)`	affected	generic	—
`10.5(1)`	affected	generic	—
`10.2(8)`	affected	generic	—
`10.3(3r)`	affected	generic	—
`10.3(6)`	affected	generic	—
`9.3(14)`	affected	generic	—
`10.4(4)`	affected	generic	—
`10.3(4h)`	affected	generic	—
`10.5(2)`	affected	generic	—
`10.3(7)`	affected	generic	—
`10.4(5)`	affected	generic	—
`10.5(3)`	affected	generic	—
`10.2(9)`	affected	generic	—
`9.3(15)`	affected	generic	—
`10.4(4g)`	affected	generic	—
`10.5(4)`	affected	generic	—
`10.6(1)`	affected	generic	—
`10.5(3t)`	affected	generic	—
`10.3(8)`	affected	generic	—
`10.4(6)`	affected	generic	—
`10.5(3s)`	affected	generic	—
`10.5(3e)`	affected	generic	—
`10.5(3o)`	affected	generic	—
`9.3(16)`	affected	generic	—
`10.6(1s)`	affected	generic	—
`10.5(3p)`	affected	generic	—
`10.5(3t)`	affected	generic	—
`10.5(3t)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the Cisco NX‑OS Software patch referenced in Cisco Security Advisory cisco‑sa‑nxos‑ether‑dos‑Kv8YNWZ4
Segment the network to eliminate direct Layer 2 adjacency between untrusted hosts and the affected switches
Configure storm‑control, traffic policing, or other loop‑protection mechanisms on the impacted interfaces
Monitor for sudden increases in broadcast or VxLAN traffic and, if a loop is detected, stop the traffic and reset the interfaces as recommended by Cisco

Generated by OpenCVE AI on April 17, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00046.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ether-dos-Kv8YNWZ4

History

Thu, 26 Feb 2026 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco nx-os Software
Vendors & Products		Cisco Cisco nx-os Software

Wed, 25 Feb 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability with the Ethernet VPN (EVPN) Layer 2 ingress packet processing of Cisco Nexus 3600 Platform Switches and Cisco Nexus 9500-R Series Switching Platforms could allow an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop. This vulnerability is due to a logic error when processing a crafted Layer 2 ingress frame. An attacker could exploit this vulnerability by sending a stream of crafted Ethernet frames through the targeted device. A successful exploit could allow the attacker to cause a Layer 2 Virtual eXtensible LAN (VxLAN) traffic loop, which, in turn, could result in a denial of service (DoS) condition. This Layer 2 loop could oversubscribe the bandwidth on network interfaces, which would result in all data plane traffic being dropped. To exploit this vulnerability, the attacker must be Layer 2-adjacent to the affected device. Note: To stop active exploitation of this vulnerability, manual intervention is required to both stop the crafted traffic and flap all involved network interfaces. For additional assistance if a Layer 2 loop that is related to this vulnerability is suspected, contact the Cisco Technical Assistance Center (TAC) or the proper support provider.
Title		Cisco Nexus 3600-R and 9500-R Series Switching Platforms Layer 2 Loop Denial of Service Vulnerability
Weaknesses		CWE-457
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ether-dos-Kv8YNWZ4
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H'}`

Subscriptions

Cisco Nx-os Software

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-02-25T16:14:33.859Z

Updated: 2026-02-25T19:05:49.650Z

Reserved: 2025-10-08T11:59:15.355Z

Link: CVE-2026-20051

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-02-25T17:25:26.487

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-20051

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-04-17T15:15:21Z

Weaknesses

CWE-457

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object