OTPulse

Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability

MonitorCVSS 5.8cisco-sa-aci-epgcbp-SfDU7NLfOct 7, 2026
CiscoTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Cisco Nexus 9000 Series Fabric Switches in ACI Mode allows an unauthenticated remote attacker to bypass configured endpoint group (EPG) contracts. The vulnerability exists in the EPG contract control logic. An attacker can exploit this by sending IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic (ports 67, 68, 546, or 547) through an affected device. Successful exploitation allows the attacker to bypass EPG contracts, potentially enabling unauthorized traffic across network segments that should be isolated. Cisco has released software updates to address this vulnerability.

What this means
What could happen
An attacker on the network could send crafted DHCP-like traffic to bypass your Nexus 9000 switches' EPG contracts, potentially allowing unauthorized traffic between network segments that should be isolated.
Who's at risk
Transportation companies and any organizations using Cisco Nexus 9000 Series Fabric Switches in ACI Mode should prioritize this update. This affects network infrastructure that depends on EPG contracts to segregate sensitive operational traffic.
How it could be exploited
An attacker sends IPv4 or IPv6 packets with UDP source and destination ports matching DHCP traffic (ports 67/68 or 546/547) toward an affected Nexus 9000 switch. The switch fails to properly enforce EPG contracts for these packets, allowing them to cross network boundaries that should be blocked.
Prerequisites
  • Network access to send traffic through the affected Nexus 9000 switch
  • Ability to craft packets using DHCP UDP ports (67, 68, 546, 547)
remotely exploitableno authentication requiredlow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
Nexus 9000 Series SwitchesAll versionsFix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Nexus 9000 Series Switches to the latest patched firmware version released by Cisco
View full vendor advisory
API: /api/v1/advisories/d5285d4c-da8d-4baa-a872-b88382e78c15

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability | CVSS 5.8 - OTPulse