# CVE-2026-20325: Cisco Nexus Dashboard command injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-20325-cisco-nexus-dashboard-command-injection-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20325 · Severity: critical · CVSS 9.9 · Published 2026-09-16

Cisco Nexus Dashboard is a centralized management and orchestration platform for data center networks. A command injection vulnerability (CVE-2026-20325) allows authenticated users to execute arbitrary commands, potentially compromising the entire managed infrastructure. This vulnerability is part of a suite of critical flaws discovered during internal security review and requires immediate patching to maintain network security.

Technologies: [Cisco Nexus Dashboard](https://junglewise.ai/threats/technologies/nexus-dashboard). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20325 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20325 being exploited in the wild.

**How severe is CVE-2026-20325?** Critical severity, with a CVSS score of 9.9, published 16 September 2026.

**Which products and versions are affected?** Cisco Nexus Dashboard 4.2 and earlier.

**Is there a fix for CVE-2026-20325?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20325 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20325?** Check whether you run Cisco Nexus Dashboard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20325 is a command injection vulnerability (CWE-77) in Cisco Nexus Dashboard caused by improper neutralization of special elements used in commands. The vulnerability requires authenticated access (PR:L in CVSS vector) and has network attack vector (AV:N). An attacker with valid credentials can inject arbitrary commands through the application interface to achieve remote code execution with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The scope is changed (S:C), indicating the vulnerability can affect resources beyond the vulnerable component. Cisco released fixed versions 4.3.1.175 and later; versions 4.2 and earlier are vulnerable with no available workarounds.

## Affected products

- Cisco Nexus Dashboard 4.2 and earlier

## Timeline

- 2026-09-16: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ndw1-psFvnrg](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ndw1-psFvnrg)

## Related threats

- [Cisco Nexus Dashboard path traversal and weak access controls](https://junglewise.ai/threats/cve-2026-76409-cisco-nexus-dashboard-path-traversal-and-weak-access-controls)
- [Cisco Nexus Dashboard information exposure and insecure handling](https://junglewise.ai/threats/cve-2026-20360-cisco-nexus-dashboard-information-exposure-and-insecure-handling)
- [Cisco Nexus Dashboard SQL injection vulnerability](https://junglewise.ai/threats/cve-2026-20361-cisco-nexus-dashboard-sql-injection-vulnerability)
- [Cisco Nexus Dashboard missing authentication for critical functions](https://junglewise.ai/threats/cve-2026-20326-cisco-nexus-dashboard-missing-authentication-for-critical)
- [Cisco Nexus Dashboard improper access control](https://junglewise.ai/threats/cve-2026-20322-cisco-nexus-dashboard-improper-access-control)