Python Sandbox Escape in Cisco NX-OS via Low-Privilege Local Access
CVE-2026-20032 Published on October 7, 2026
Cisco NX-OS Software Python Sandbox Escape Vulnerability
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.
Vulnerability Analysis
CVE-2026-20032 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Separation of Privilege Vulnerability?
The product does not sufficiently compartmentalize functionality or processes that require different privilege levels, rights, or permissions. When a weakness occurs in functionality that is accessible by lower-privileged users, then without strong boundaries, an attack might extend the scope of the damage to higher-privileged users.
CVE-2026-20032 has been classified to as a Separation of Privilege vulnerability or weakness.
Products Associated with CVE-2026-20032
Want to know whenever a new CVE is published for Cisco Nx Os? stack.watch will email you.
Affected Versions
Cisco NX-OS Software:- Version 8.2(5) is affected.
- Version 7.3(5)D1(1) is affected.
- Version 8.4(2) is affected.
- Version 8.4(3) is affected.
- Version 9.2(3) is affected.
- Version 8.2(1) is affected.
- Version 7.3(1)D1(1) is affected.
- Version 9.2(2v) is affected.
- Version 7.3(0)D1(1) is affected.
- Version 7.3(4)D1(1) is affected.
- Version 9.2(1) is affected.
- Version 9.2(2t) is affected.
- Version 9.2(3y) is affected.
- Version 9.3(2) is affected.
- Version 7.3(1)DY(1) is affected.
- Version 8.1(1) is affected.
- Version 8.2(2) is affected.
- Version 8.3(2) is affected.
- Version 7.3(2)D1(3a) is affected.
- Version 9.2(4) is affected.
- Version 8.1(2) is affected.
- Version 7.3(3)D1(1) is affected.
- Version 8.2(3) is affected.
- Version 8.3(1) is affected.
- Version 8.4(1) is affected.
- Version 8.1(1b) is affected.
- Version 7.3(0)DX(1) is affected.
- Version 7.3(2)D1(1) is affected.
- Version 9.3(1) is affected.
- Version 7.3(2)D1(2) is affected.
- Version 8.2(4) is affected.
- Version 7.3(0)DY(1) is affected.
- Version 9.3(1z) is affected.
- Version 9.2(2) is affected.
- Version 8.1(2a) is affected.
- Version 7.3(2)D1(3) is affected.
- Version 8.1(1a) is affected.
- Version 8.4(1a) is affected.
- Version 9.3(3) is affected.
- Version 7.3(2)D1(1d) is affected.
- Version 9.3(4) is affected.
- Version 7.3(6)D1(1) is affected.
- Version 8.2(6) is affected.
- Version 9.3(5) is affected.
- Version 8.4(2a) is affected.
- Version 8.4(2b) is affected.
- Version 8.5(1) is affected.
- Version 9.3(6) is affected.
- Version 8.4(4) is affected.
- Version 7.3(7)D1(1) is affected.
- Version 8.4(2c) is affected.
- Version 9.3(5w) is affected.
- Version 8.2(7) is affected.
- Version 9.3(7) is affected.
- Version 9.3(7k) is affected.
- Version 7.3(8)D1(1) is affected.
- Version 9.3(7a) is affected.
- Version 8.2(7a) is affected.
- Version 9.3(8) is affected.
- Version 8.4(4a) is affected.
- Version 8.4(2d) is affected.
- Version 8.4(5) is affected.
- Version 8.2(8) is affected.
- Version 9.3(9) is affected.
- Version 7.3(9)D1(1) is affected.
- Version 8.4(6) is affected.
- Version 8.4(2e) is affected.
- Version 9.3(10) is affected.
- Version 9.2(1a) is affected.
- Version 8.2(9) is affected.
- Version 10.3(1) is affected.
- Version 8.4(7) is affected.
- Version 10.3(2) is affected.
- Version 8.4(6a) is affected.
- Version 9.3(11) is affected.
- Version 10.3(3) is affected.
- Version 9.4(1) is affected.
- Version 9.3(2a) is affected.
- Version 8.4(2f) is affected.
- Version 8.2(10) is affected.
- Version 9.3(12) is affected.
- Version 10.4(1) is affected.
- Version 8.4(8) is affected.
- Version 10.3(99w) is affected.
- Version 10.3(3w) is affected.
- Version 10.3(99x) is affected.
- Version 10.3(3o) is affected.
- Version 8.4(9) is affected.
- Version 10.3(4) is affected.
- Version 10.3(3p) is affected.
- Version 10.3(4a) is affected.
- Version 9.4(1a) is affected.
- Version 10.4(2) is affected.
- Version 10.3(3q) is affected.
- Version 9.3(13) is affected.
- Version 8.2(11) is affected.
- Version 9.4(2) is affected.
- Version 10.3(5) is affected.
- Version 10.4(3) is affected.
- Version 10.3(3x) is affected.
- Version 10.3(4g) is affected.
- Version 10.5(1) is affected.
- Version 8.4(10) is affected.
- Version 9.4(2a) is affected.
- Version 10.3(3r) is affected.
- Version 10.3(6) is affected.
- Version 9.3(14) is affected.
- Version 10.4(4) is affected.
- Version 10.3(4h) is affected.
- Version 10.5(2) is affected.
- Version 8.4(11) is affected.
- Version 9.4(3) is affected.
- Version 10.3(7) is affected.
- Version 10.4(5) is affected.
- Version 10.5(3) is affected.
- Version 9.3(15) is affected.
- Version 9.4(3a) is affected.
- Version 10.4(4g) is affected.
- Version 10.5(4) is affected.
- Version 9.4(3b) is affected.
- Version 8.4(12) is affected.
- Version 10.6(1) is affected.
- Version 10.5(3t) is affected.
- Version 10.3(8) is affected.
- Version 10.4(6) is affected.
- Version 10.5(3s) is affected.
- Version 10.5(3e) is affected.
- Version 9.4(4) is affected.
- Version 10.5(3o) is affected.
- Version 9.3(16) is affected.
- Version 10.6(1s) is affected.
- Version 10.6(2) is affected.
- Version 10.5(3p) is affected.
- Version 9.4(5) is affected.
- Version 10.3(9) is affected.
- Version 10.6(2s) is affected.
- Version 8.4(13) is affected.
- Version 10.6(3) is affected.
- Version 10.4(7) is affected.
- Version 10.5(5) is affected.
- Version 9.3(17) is affected.
- Version 10.6(2n) is affected.
- Version 10.6(3s) is affected.