{"id":"CVE-2026-20032","revision":"686ca78d0c1b4c31bbfc696123661628","records":[{"revision":"686ca78d0c1b4c31bbfc696123661628","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-20032","aliases":[],"title":"Cisco NX-OS Software Python Sandbox Escape Vulnerability","description":"A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.","state":0,"publishedAt":"2026-10-07T16:11:55.157+00:00","modifiedAt":"2026-10-07T19:23:47.285+00:00","affected":[{"ecosystem":"Vendor product","name":"Cisco NX-OS Software","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Cisco\",\n                    \"product\": \"Cisco NX-OS Software\",\n                    \"versions\": [\n                        {\n                            \"version\": \"8.2(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(5)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(1)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(2v)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(0)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(4)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(2t)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(3y)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(1)DY(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.3(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(2)D1(3a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.1(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(3)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.3(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.1(1b)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(0)DX(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(2)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(2)D1(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(0)DY(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(1z)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.1(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(2)D1(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.1(1a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(1a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(2)D1(1d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(6)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(6)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2b)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.5(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(6)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(7)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(5w)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(7)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(7)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(7k)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(8)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(7a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(7a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(8)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(4a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(8)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(9)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"7.3(9)D1(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(6)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(10)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.2(1a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(9)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(7)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(6a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(11)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(10)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(12)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(8)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(99w)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3w)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(99x)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3o)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(9)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3p)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(4a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(1a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3q)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(13)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.2(11)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3x)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(4g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(10)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(3r)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(6)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(14)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(4h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(11)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(7)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(15)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(3a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(4g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(3b)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(12)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(1)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3t)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(8)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(6)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3s)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(4)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3o)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(16)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(1s)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(2)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(3p)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.4(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.3(9)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(2s)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"8.4(13)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(3)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.4(7)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.5(5)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"9.3(17)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(2n)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"10.6(3s)\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.4,"severity":"MEDIUM"}],"references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-20032","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-20032","identifiers":["CVE-2026-20032"]},"retained":false,"historicalAffected":[]}],"coverage":[]}