CVE-2026-20038CWE-284broken-access-control

CVE-2026-20038

Medium · published October 7, 2026

CVSS v3.1
5.8
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.

This vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-07T21:16Z
References (1)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf · [email protected]
EPSS history
Timeline
  • 09 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 07 OCT 16:11Z
    Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability
    cvelistv5