CVE-2026-20361 — CVE & Security Advisory Radar

🎯 CVE-2026-20361 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-20361 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.

Klassifikation & Betroffenheit:

CWE-89 Cisco Cisco Nexus Dashboard 3.1(1k)Cisco Nexus Dashboard 3.3(1a)Cisco Nexus Dashboard 3.0(1f)Cisco Nexus Dashboard 2.2(1e)Cisco Nexus Dashboard 3.1(1l)Cisco Nexus Dashboard 3.1(1n)Cisco Nexus Dashboard 2.3(2e)Cisco Nexus Dashboard 3.3(2b)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 🎯 High

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as…

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. For example, consider using persistence layers such as Hibernate or Enterprise Java Beans, which can provide significant protection against SQL injection if used proper…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-7 · Blind SQL Injection (High) CAPEC-66 · SQL Injection (High) CAPEC-108 · Command Line Execution through SQL Injec… (Very High) CAPEC-109 · Object Relational Mapping Injection (High) CAPEC-110 · SQL Injection through SOAP Parameter Tam… (Very High) CAPEC-470 · Expanding Control over the Operating Sys… (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-76460 10.0 CVE-2026-76423 10.0 CVE-2026-20130 10.0 CVE-2026-20192 10.0 CVE-2026-20315 10.0

📰 Eigene Berichterstattung: ➔ CVE-2026-20361 | Cisco Nexus Dashboard up to 4.2.1 sql injection (Nessus ID 3482

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

🔗 sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvi…

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 09/2026

Heute 19.09.

CVSS-Vektor-Analyse: 8.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:16.09.2026

Aktualisiert:16.09.2026 20:08

Assigner (CNA):cisco

EUVD-ID:EUVD-2026-81105

CWE-89 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Management-Interface vom Internet trennen und ACLs auf vertrauenswürdige IPs beschränken.

Tier	2026-08-30	2026-09-18
≥90 %	0	0
≥50 %	0	0
≥10 %	0	0
<10 %	300	300

EPSS

18.1%

CVE-2026-20361 🌐 Netzwerk (Remote) 🔑 Geringe Nutzerrechte nötig

Cisco

CVE-2026-20361 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.

CWE-89 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Management-Interface vom Internet trennen und ACLs auf vertrauenswürdige IPs beschränken.

16.09.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub