CVE-2026-20361: Cisco Nexus Dashboard SQL Injection Vulnerability

CVE-2026-20361 Overview

Cisco disclosed CVE-2026-20361 as part of an internal security review of the Cisco Nexus Dashboard. The engineering team identified multiple SQL injection weaknesses grouped under [CWE-89]. Cisco addressed the issues in a software hardening release for the Nexus Dashboard product line.

The vulnerability allows an authenticated remote attacker to influence backend database queries. Successful exploitation can compromise the confidentiality, integrity, and availability of data managed by the Nexus Dashboard.

Critical Impact
An authenticated attacker with low privileges can execute crafted SQL statements over the network, potentially exposing sensitive fabric management data and altering platform state.

Affected Products

Cisco Nexus Dashboard (versions addressed by the hardening release referenced in advisory cisco-sa-hardening-ndw1-psFvnrg)
Deployments exposing the Nexus Dashboard web management interface
Environments using Nexus Dashboard for data center fabric orchestration

Discovery Timeline

2026-09-16 - CVE-2026-20361 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-20361

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in the Cisco Nexus Dashboard. It was uncovered during an internal Cisco security review rather than external research. Cisco grouped multiple related SQL injection issues under this single CVE identifier.

An authenticated attacker with network access to the management interface can send crafted input to affected components. The input is incorporated into database queries without adequate sanitization or parameterization. This allows the attacker to alter query logic and interact with backend data outside the intended scope.

Because the Nexus Dashboard orchestrates data center fabrics and stores operational state, successful exploitation can expose credentials, topology data, and configuration artifacts. It can also let an attacker modify records that drive fabric automation workflows.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. Affected code paths concatenate untrusted user-controlled input into SQL statements instead of using parameterized queries or prepared statements. The application also fails to enforce strict input validation on the affected parameters.

Attack Vector

Exploitation is remote and requires low-level authentication to the Nexus Dashboard. No user interaction is needed. An attacker submits crafted request parameters to a vulnerable endpoint over the network. The injected payload changes the semantics of the resulting SQL query executed by the backend database.

No public proof-of-concept code has been published for this issue. See the Cisco Security Advisory on Hardening for authoritative technical details.

Detection Methods for CVE-2026-20361

Indicators of Compromise

Unexpected database errors or stack traces surfaced in Nexus Dashboard application logs
Web access logs showing SQL metacharacters such as single quotes, UNION, --, or ; in request parameters from authenticated sessions
New or modified database records that do not correspond to legitimate administrative activity

Detection Strategies

Inspect Nexus Dashboard HTTP request logs for anomalous parameter values submitted by low-privileged accounts
Correlate authentication events with subsequent unusual query patterns or elevated data access volume
Deploy a web application firewall in front of the Nexus Dashboard management interface to flag SQL injection signatures

Monitoring Recommendations

Forward Nexus Dashboard audit and application logs to a centralized SIEM for retention and correlation
Alert on authentication from unexpected source ranges or service accounts accessing administrative endpoints
Monitor outbound connections from the Nexus Dashboard host to identify data staging or exfiltration attempts

How to Mitigate CVE-2026-20361

Immediate Actions Required

Apply the Cisco Nexus Dashboard hardening release referenced in advisory cisco-sa-hardening-ndw1-psFvnrg as soon as change windows allow
Restrict network access to the Nexus Dashboard management interface to trusted administrative subnets
Audit local and remote user accounts, remove unused credentials, and rotate passwords for privileged operators

Patch Information

Cisco published a software hardening release addressing CVE-2026-20361 alongside other internally discovered issues. Refer to the Cisco Security Advisory on Hardening for fixed version details and upgrade guidance specific to your deployment model.

Workarounds

Cisco has not documented a supported workaround; upgrading to the fixed release is the recommended remediation
Enforce least privilege on Nexus Dashboard accounts to limit the impact of any authenticated exploitation attempt
Place the management interface behind a jump host or bastion with multi-factor authentication until patching completes

bash

# Verify Nexus Dashboard version and restrict management access
# Confirm running version before and after upgrade
acs version

# Example firewall rule limiting access to the management VLAN
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP