{"id":"CVE-2026-20038","revision":"1ca09ead03f3404b8b65251ebf14e2f7","records":[{"revision":"1ca09ead03f3404b8b65251ebf14e2f7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-20038","aliases":[],"title":"Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability","description":"A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric Switches in ACI Mode could allow an unauthenticated, remote attacker to bypass configured EPG contracts.\r\n\r\nThis vulnerability is due to an improper control with EPG contracts. An attacker could exploit this vulnerability by sending IPv4 or IPv6 packets using UDP source and destination ports that are assigned to DHCP traffic through an affected device. A successful exploit could allow the attacker to bypass EPG contracts on the affected device.","state":0,"publishedAt":"2026-10-07T16:11:55.078+00:00","modifiedAt":"2026-10-07T18:05:53.253+00:00","affected":[{"ecosystem":"Vendor product","name":"Cisco NX-OS System Software in ACI Mode","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Cisco\",\n                    \"product\": \"Cisco NX-OS System Software in ACI Mode\",\n                    \"versions\": [\n                        {\n                            \"version\": \"15.2(1g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(2e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(2g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(2h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(3f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(3e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(3g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(4d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(4e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(5c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(5d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(1g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(5e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(4f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(6e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(6h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(1j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(6g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(7f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(7g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(2h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(2j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(3d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(3e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(1d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(4c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2a)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.2(8i)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(5h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2b)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(3g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(5j)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(6c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(1f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(7e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(8e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(8f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(2g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"15.3(2f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(9c)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(3f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(9d)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(6h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(8h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(3g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(9e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(4h)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.1(5e)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.2(1g)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.0(9f)\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"16.2(2e)\",\n                            \"status\": \"affected\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-20038","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-20038","identifiers":["CVE-2026-20038"]},"retained":false,"historicalAffected":[]}],"coverage":[]}