Cisco Fixes NX-OS Python Sandbox Escape and Control Plane DoS Flaws
Cisco has released software updates for two vulnerabilities in NX-OS, including a Python sandbox escape and a remote denial-of-service flaw.
Key points
- An authenticated local attacker can escape the Python sandbox to gain OS access.
- An unauthenticated remote attacker can cause a denial of service via improper rate limiting.
- Cisco has released software updates addressing both issues; no workarounds exist.
Cisco has released software updates to address two vulnerabilities in its NX-OS Software, including a flaw that allows an authenticated local attacker to escape a Python sandbox and another that enables remote denial-of-service attacks. The advisories were published as part of a group of security notices on October 7, 2026.
At a glance
- Publisher
- Cisco PSIRT
- CVEs
- See advisory
The first vulnerability involves the Python interpreter within NX-OS. Due to insufficient validation of user-supplied input, an attacker with low privileges who is already authenticated can manipulate specific functions to escape the Python sandbox. A successful exploit grants the attacker unauthorized access to the underlying operating system, allowing them to execute arbitrary commands with the privileges of the authenticated user. Cisco notes that an attacker must possess Python execution privileges to exploit this issue.
Context and Background
The second vulnerability affects the control plane of NX-OS devices. It stems from improper application of rate limiting to certain protocols. An unauthenticated, remote attacker can exploit this by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. This action exhausts system resources, leading to a denial-of-service condition.
According to Cisco, a successful exploit causes instability in various routing and control plane protocols through packet loss and temporary disruptions. The company rates the security impact of this denial-of-service vulnerability as Medium and has assigned it CVE-2026-20173. The disruption is temporary; the DoS condition clears without manual intervention shortly after the high rate of traffic stops.
Who Is Affected
Both vulnerabilities affect devices running Cisco NX-OS Software. The Python sandbox escape requires the target to have Python execution enabled, as detailed in product-specific documentation such as the Cisco Nexus 9000 Series NX-OS Programmability Guide. The control plane denial-of-service vulnerability affects any device where the improper rate limiting exists, allowing remote attackers to target data plane interfaces without prior authentication.
What should you do?
Cisco has released software updates that address both vulnerabilities. There are no workarounds available for either issue. Administrators should apply the latest software updates to mitigate these risks. For further documentation on improvements and fixes, users can refer to the Cisco NX-OS Software Security Hardening Release for October 2026. The official advisories are available via Cisco’s security center.
What to do and how to stay safe: Cisco
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Can an unauthenticated attacker exploit the Python sandbox escape vulnerability?
No, the attacker must be authenticated and have low privileges with Python execution privileges to exploit the sandbox escape.
Does the control plane DoS vulnerability require manual intervention to resolve?
No, the denial-of-service condition clears automatically soon after the high rate of traffic is stopped.
Are there any workarounds for these vulnerabilities?
No, Cisco states there are no workarounds that address either vulnerability; software updates are required.
