CVE-2026-20048

High

Published: 25 February 2026

Published

25 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS Score 0.0026 49.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-20048 is a high-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 49.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Remediates the improper SNMP request processing flaw by applying vendor patches to the Cisco Nexus 9000 SNMP subsystem.

SC-5 Denial-of-service Protection good match

prevent

Protects against the DoS condition by implementing denial-of-service mitigations such as rate limiting on SNMP queries to prevent kernel panic.

SI-9 Information Input Restrictions good match

prevent

Restricts the quantity and rate of SNMP inputs to the specific vulnerable MIB, preventing resource exhaustion and continuous query exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Authenticated remote SNMP queries trigger kernel panic/reload, directly enabling application/system exploitation for DoS impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability…

is due to improper processing when parsing SNMP requests. An attacker could exploit this vulnerability by continuously sending SNMP queries to a specific MIB of an affected device. A successful exploit could allow the attacker to cause a kernel panic on the device, resulting in a reload and a DoS condition. Note: This vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMPv1 or SNMPv2c, the attacker must have a valid read-only SNMP community string for the affected system. To exploit this vulnerability through SNMPv3, the attacker must have valid SNMP user credentials for the affected system.

Deeper analysisAI

CVE-2026-20048 is a vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Nexus 9000 Series Fabric Switches operating in ACI mode. Published on 2026-02-25, the flaw arises from improper processing of SNMP requests and has a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H), associated with CWE-789. It affects SNMP versions 1, 2c, and 3.

An authenticated remote attacker can exploit the vulnerability by continuously sending SNMP queries to a specific MIB on an affected device. This triggers a kernel panic, causing the device to reload and resulting in a denial-of-service (DoS) condition. For SNMPv1 or SNMPv2c, the attacker requires a valid read-only SNMP community string; for SNMPv3, valid SNMP user credentials are needed.

The Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-dsnmp-cNN39Uh provides further details on this vulnerability, including mitigation and patch information.