# CVE-2026-20361

SQL injection in Cisco Nexus Dashboard allowing DB access and manipulation.

- Page: https://www.vulneraibility.com/cve/CVE-2026-20361
- CVSS: 8.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.41% (percentile 35.6)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-17)
- Weakness: CWE-89
- Published: 2026-09-16

## Affected versions

- Cisco Cisco Nexus Dashboard: affected 2.1(1d); 2.1(1e); 2.1(2d); 2.2(1h); 2.2(1e); 2.2(2d); 2.1(2f); 2.3(1c); 2.3(2b); 2.3(2c); 2.3(2d); 2.3(2e); 3.0(1f); 3.0(1i); 3.1(1k); 3.1(1l); 3.2(1e); 3.2(1i); 3.3(1a); 3.3(1b); 3.3(2b); 4.0(1i); 3.3(2g); 3.2(2f); 3.2(2g); 3.2(2m); 3.1(1n); 4.1(1g); 4.2.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

SQL injection lets attackers execute arbitrary DB queries to read, modify, exfiltrate, or corrupt dashboard data and impair management functions.

## Action

Immediate action required

## Recommendation

Install Cisco Nexus Dashboard hardening update immediately and audit logs/inputs.

## References

- [other] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ndw1-psFvnrg

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.