OTPulse

Cisco NX-OS Software Python Sandbox Escape Vulnerability

MonitorCVSS 4.4cisco-sa-nxos-mppe-dhKZAFgbOct 7, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges and Python execution privileges to escape the Python sandbox and execute arbitrary OS commands on affected MDS 9000 Multilayer Directors, Fabric Switches, and Nexus 3000, 7000, and 9000 Series Switches. The vulnerability is due to insufficient validation of user-supplied input in the Python interpreter. A successful exploit would allow the attacker to run arbitrary commands with the privileges of the authenticated user.

What this means
What could happen
An authenticated attacker with low privileges and Python execution capabilities could escape the Python sandbox on your switch and run arbitrary commands on the device's operating system, potentially modifying network configurations or disrupting fabric operations.
Who's at risk
This affects network infrastructure operators running Cisco NX-OS switches (Nexus 3000, 7000, 9000 series) or MDS fabric switches in data center or storage network environments. Any organization using these devices for core switching, fabric operations, or multi-protocol support should evaluate their exposure.
How it could be exploited
An attacker with valid local user credentials and Python execution privileges manipulates specific Python interpreter functions to break out of the sandbox, then executes OS commands with the same user privileges on the affected Nexus or MDS switch.
Prerequisites
  • Valid local user account on the device
  • Python execution privileges enabled on the device
  • Low privilege level sufficient to access Python interpreter
Requires valid local credentialsRequires Python execution privileges to be enabledLow attack complexityCould allow privilege escalation within the deviceAffects core network infrastructure devices
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
MDS 9000 Multilayer Directors and Fabric SwitchesAll versionsFix available
Nexus 7000 Series SwitchesAll versionsFix available
Nexus 3000 Series SwitchesAll versionsFix available
Nexus 9000 Series SwitchesAll versionsFix available
Remediation & Mitigation
0/6
Do now
0/2
HARDENINGReview and restrict Python execution privileges to only authorized users who require this capability
HARDENINGImplement local access controls and limit SSH/console access to trusted administrative users only
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

MDS 9000 Multilayer Directors and Fabric Switches
HOTFIXUpdate Cisco MDS 9000 Multilayer Directors and Fabric Switches to the patched NX-OS version
Nexus 7000 Series Switches
HOTFIXUpdate Cisco Nexus 7000 Series Switches to the patched NX-OS version
Nexus 3000 Series Switches
HOTFIXUpdate Cisco Nexus 3000 Series Switches to the patched NX-OS version
Nexus 9000 Series Switches
HOTFIXUpdate Cisco Nexus 9000 Series Switches to the patched NX-OS version
View full vendor advisory
API: /api/v1/advisories/15d0f173-0874-470d-8363-c163a53b6f32

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco NX-OS Software Python Sandbox Escape Vulnerability | CVSS 4.4 - OTPulse