Executive brief
A vulnerability in Cisco Nexus 3000 and 9000 series switches could allow a remote attacker to disrupt network traffic. These switches are critical networking hardware used to route data in data centers and corporate environments. By sending a specially crafted routing update, an attacker can cause the switch to repeatedly drop and restart its connections with other network devices, leading to a denial of service condition that impacts network availability.
Technical details
The vulnerability exists in the Border Gateway Protocol (BGP) 'enforce-first-as' feature of Cisco NX-OS. The root cause is the incorrect parsing of a transitive BGP attribute (specifically related to ATTR_SET/attribute 128). An unauthenticated remote attacker can exploit this by sending a crafted BGP update through an established BGP peer session. If the update propagates to an affected device, it triggers a 'malformed as path error,' causing the device to drop the BGP session and flap. This results in a denial of service (DoS) for the affected routing paths. Cisco has released software updates and provided workarounds involving the 'path-attribute discard' or 'no enforce-first-as' commands.
Affected products
- Cisco Nexus 3000 Series Switches Standalone NX-OS mode with BGP configured
- Cisco Nexus 9000 Series Switches Standalone NX-OS mode with BGP configured
Timeline
- 2026-05-20: advisory: Initial publication of Cisco advisory cisco-sa-bgp-iefab-3hb2pwtx
- 2026-05-20: disclosed