CVE-2021-1227: Cisco NX-OS

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the NX-API on an affected device. An attacker could exploit this vulnerability by persuading a user of the NX-API to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. The attacker could view and modify the device configuration. Note: The NX-API feature is disabled by default.

Affected products

• Cisco NX-OS: version 8.4(2a) only; version 8.4(3) only; version 8.4(3)s19 only; version 9.3(3)idi9(0.569) only; version 7.3(8)n1(0.809) only

Published 2021-02-24. Last modified 2026-06-17.