Is CVE-2026-20174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20174 being exploited in the wild.

How severe is CVE-2026-20174?

Medium severity, with a CVSS score of 4.9, published 1 April 2026.

Which products and versions are affected?

Cisco Nexus Dashboard Up to and including 6.5.0; Cisco Nexus Dashboard Insights Up to and including 6.5.0.

Is there a fix for CVE-2026-20174?

A patch was published on 2026-04-01: Fixed in Nexus Dashboard 4.2.1 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20174 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-20174?

Check whether you run Cisco Nexus Dashboard or Cisco Nexus Dashboard Insights at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20174: Cisco Nexus Dashboard Insights arbitrary file write in Metadata update feature

CVE-2026-20174 · Severity: medium · CVSS 4.9 · Published 2026-04-01

Cisco Nexus Dashboard Insights, a tool used for monitoring and analyzing data center network performance, contains a security flaw in its metadata update feature. An authorized administrator could upload a specially crafted file to write unauthorized data to the system's underlying operating system with the highest level of access (root). While this could lead to a full system compromise, the risk is mitigated by the fact that the attacker must already possess valid administrative credentials.

Technologies: Cisco Nexus Dashboard. Vendors: Cisco.

Quick answers

Is CVE-2026-20174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20174 being exploited in the wild.
How severe is CVE-2026-20174?: Medium severity, with a CVSS score of 4.9, published 1 April 2026.
Which products and versions are affected?: Cisco Nexus Dashboard Up to and including 6.5.0; Cisco Nexus Dashboard Insights Up to and including 6.5.0.
Is there a fix for CVE-2026-20174?: A patch was published on 2026-04-01: Fixed in Nexus Dashboard 4.2.1 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20174 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20174?: Check whether you run Cisco Nexus Dashboard or Cisco Nexus Dashboard Insights at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights (and integrated versions within Nexus Dashboard) allows for an arbitrary file write. The root cause is insufficient validation of metadata update files during the manual upload process (CWE-22). An attacker with valid administrative credentials can exploit this by crafting a malicious metadata file and uploading it via the management interface. Successful exploitation allows the attacker to write files to any location on the underlying Linux filesystem with root-level permissions. This vulnerability affects both air-gapped and cloud-connected deployments, as the manual upload option is available in both. Cisco has released software updates to address this issue; no workarounds are available.

Affected products

Cisco Nexus Dashboard Insights Up to and including 6.5.0
Cisco Nexus Dashboard 3.1(1k) through 4.1(1g)

Timeline

2026-04-01: advisory: Initial public release by Cisco
2026-04-01: patched: Fixed in Nexus Dashboard 4.2.1 and later

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndi-afw-rJuRC5dZ

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.