CVE-2026-20051 is a high-severity vulnerability affecting Cisco Nexus 3600 Platform Switches and Nexus 9500-R Series Switching Platforms, allowing an unauthenticated, adjacent attacker to trigger a Layer 2 traffic loop. This is due to a logic error in Ethernet VPN (EVPN) Layer 2 ingress packet processing, exploitable by sending crafted Ethernet frames. A successful exploit leads to a denial of service (DoS) by oversubscribing network bandwidth and dropping all data plane traffic. The vulnerability has a CVSS score of 7.4 (HIGH) with an adjacent attack vector and low attack complexity, requiring manual intervention to stop. There is no evidence of active exploitation, public exploit code, or KEV listing, but it has garnered some community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Cisco | Cisco NX-OS Software | 10.2(1), 10.2(1q), 10.2(2), 10.2(2a), 10.2(3), 10.2(3t), 10.2(3v), 10.2(4), 10.2(5), 10.2(6), 10.2(7), 10.2(8), 10.2(9), 10.3(1), 10.3(2), 10.3(3), 10.3(3o), 10.3(3p), 10.3(3q), 10.3(3r), 10.3(3w), 10.3(3x), 10.3(4), 10.3(4a), 10.3(4g), 10.3(4h), 10.3(5), 10.3(6), 10.3(7), 10.3(8), 10.4(1), 10.4(2), 10.4(3), 10.4(4), 10.4(4g), 10.4(5), 10.4(6), 10.5(1), 10.5(2), 10.5(3), 10.5(3e), 10.5(3o), 10.5(3p), 10.5(3s), 10.5(3t), 10.5(4), 10.6(1), 10.6(1s), 9.2(1), 9.2(2), 9.2(2t), 9.2(2v), 9.2(3), 9.2(3y), 9.2(4), 9.3(1), 9.3(10), 9.3(11), 9.3(12), 9.3(13), 9.3(14), 9.3(15), 9.3(16), 9.3(1z), 9.3(2), 9.3(3), 9.3(4), 9.3(5), 9.3(5w), 9.3(6), 9.3(7), 9.3(7a), 9.3(7k), 9.3(8), 9.3(9)CNA affecteddefault unknown |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.