CVE-2026-20174: Cisco Nexus Dashboard · Path Traversal
Affects Cisco Nexus DashboardSource CVE Database V5
Not known to be exploited · CVSS 4.9 Medium.
Data as of 30 Oct 2026, 06:59 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 1 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| CiscoCisco Nexus Dashboard | Affected
| Fixed in– |
| CiscoCisco Nexus Dashboard Insights | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2026-20174, organizations should: 1) Restrict administrative access to Nexus Dashboard systems using strong authentication methods, including multi-factor authentication and strict access controls. 2) Limit the use of manual metadata file uploads, especially in air-gapped environments, and monitor all upload activities for anomalies. 3) Implement network segmentation to isolate Nexus Dashboard systems from less trusted networks and users. 4) Regularly audit and rotate administrative credentials to reduce the risk of credential compromise. 5) Monitor system logs and file integrity to detect unauthorized file writes or suspicious activities. 6) Apply vendor patches promptly once available. 7) Consider deploying host-based intrusion detection systems (HIDS) on Nexus Dashboard hosts to alert on unauthorized file modifications. 8) Educate administrators on the risks of this vulnerability and enforce strict operational procedures for metadata updates.
Description
A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient validation of the metadata update file. An attacker could exploit this vulnerability by crafting a metadata update file and manually uploading it to an affected device. A successful exploit could allow the attacker to write arbitrary files to the underlying operating system as the root user. To exploit this vulnerability, the attacker must have valid administrative credentials. Note: Manual uploading of metadata files is typical for Air-Gap environments but not for Cisco Intersight Cloud connected devices. However, the manual upload option exists for both deployments.