Connection Attempt to Cisco Nexus 9000 S1HAL Service (CVE-2026-20212)

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•2

This rule detects unauthenticated TCP connection attempts targeting ports 43210 and 43211, which are associated with the Nexus 9000 S1HAL service. These attempts are indicative of potential exploitation activity related to CVE-2026-20212.