Cisco Nexus Dashboard vulnerabilities

26 CVEs affecting Cisco Nexus Dashboard, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20174, published 2026-04-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2022-20857, published 2022-07-21. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request…
CVE-2022-20858, published 2022-07-21. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request…
CVE-2022-20913, published 2022-07-22. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to insufficient input validation in…
CVE-2023-20014, published 2023-03-01. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability in the DNS functionality of Cisco Nexus Dashboard Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due…
CVE-2022-20861, published 2022-07-21. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request…
CVE-2025-20344, published 2025-08-27. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This…
CVE-2022-20860, published 2022-07-21. High severity, CVSS 7.4. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive…
CVE-2025-20150, published 2025-04-16. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to enumerate LDAP user accounts. This vulnerability is due to the improper handling of LDAP authentication…
CVE-2023-20053, published 2023-03-01. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the…

Latest

CVE-2026-20174, published 2026-04-01. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is…
CVE-2026-20042, published 2026-04-01. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encryption password and access to Full or Config-only backup files to access sensitive…
CVE-2025-20348, published 2025-08-27. Medium severity, CVSS 5.0. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive…
CVE-2025-20347, published 2025-08-27. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive…
CVE-2025-20163, published 2025-06-04. High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This…
CVE-2024-20477, published 2024-10-02. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to upload or delete files on an affected device. This vulnerability…
CVE-2024-20442, published 2024-10-02. Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected…
CVE-2024-20441, published 2024-10-02. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability…