Nexus 9000 ACI EPG Contract Bypass Vulnerability
CVE-2026-20038 Published on October 7, 2026
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability
A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.
This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.
Vulnerability Analysis
CVE-2026-20038 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-20038 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-20038
Want to know whenever a new CVE is published for Cisco Nx Os? stack.watch will email you.
Affected Versions
Cisco NX-OS System Software in ACI Mode:- Version 15.2(1g) is affected.
- Version 15.2(2e) is affected.
- Version 15.2(2f) is affected.
- Version 15.2(2g) is affected.
- Version 15.2(2h) is affected.
- Version 15.2(3f) is affected.
- Version 15.2(3e) is affected.
- Version 15.2(3g) is affected.
- Version 15.2(4d) is affected.
- Version 15.2(4e) is affected.
- Version 15.2(5c) is affected.
- Version 15.2(5d) is affected.
- Version 16.0(1g) is affected.
- Version 15.2(5e) is affected.
- Version 15.2(4f) is affected.
- Version 15.2(6e) is affected.
- Version 15.2(6h) is affected.
- Version 16.0(1j) is affected.
- Version 15.2(6g) is affected.
- Version 15.2(7f) is affected.
- Version 15.2(7g) is affected.
- Version 16.0(2h) is affected.
- Version 15.2(8d) is affected.
- Version 16.0(2j) is affected.
- Version 15.2(8e) is affected.
- Version 16.0(3d) is affected.
- Version 16.0(3e) is affected.
- Version 15.2(8f) is affected.
- Version 15.2(8g) is affected.
- Version 15.3(1d) is affected.
- Version 15.2(8h) is affected.
- Version 16.0(4c) is affected.
- Version 15.3(2a) is affected.
- Version 15.2(8i) is affected.
- Version 16.0(5h) is affected.
- Version 15.3(2b) is affected.
- Version 16.0(3g) is affected.
- Version 16.0(5j) is affected.
- Version 15.3(2c) is affected.
- Version 16.0(6c) is affected.
- Version 15.3(2d) is affected.
- Version 16.1(1f) is affected.
- Version 16.0(7e) is affected.
- Version 16.0(8e) is affected.
- Version 15.3(2e) is affected.
- Version 16.0(8f) is affected.
- Version 16.1(2f) is affected.
- Version 16.1(2g) is affected.
- Version 15.3(2f) is affected.
- Version 16.0(9c) is affected.
- Version 16.1(3f) is affected.
- Version 16.0(9d) is affected.
- Version 16.0(6h) is affected.
- Version 16.0(8h) is affected.
- Version 16.1(3g) is affected.
- Version 16.0(9e) is affected.
- Version 16.1(4h) is affected.
- Version 16.1(5e) is affected.
- Version 16.2(1g) is affected.
- Version 16.0(9f) is affected.
- Version 16.2(2e) is affected.