Five critical vulnerabilities in Cisco's NX-OS could allow an attacker to run arbitrary code with root privileges on Nexus switches, or — if code execution is not attained — to crash processes and force a device reload, producing a denial-of-service condition.
The risk: remote code execution and denial-of-service on Nexus 3000 and 9000
Cisco released security advisories describing five critical flaws that affect Nexus 3000 and Nexus 9000 Series switches running NX-OS in standalone mode. Successful exploitation can yield arbitrary code execution with root privileges; when code execution is not achieved, the same flaws can be used to crash processes and trigger device reloads, causing network outages.
Which features and models must be active for exploitation
The vendor makes clear that the issues are tied to three NX-OS features: NX-API, Next Generation OAM (NGOAM), and MPLS OAM. The vulnerabilities affect Nexus 3000 and Nexus 9000 Series switches in standalone NX-OS mode only, and exploitation depends on at least one of those features being active on the affected device. Cisco also notes that Nexus 7000 switches and Nexus 9000 switches operating in ACI mode are not affected by any of the five vulnerabilities.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhat each CVE requires to be exploitable
- CVE-2026-76471 — Insufficient input validation. Can be exploited through a crafted HTTP request sent to the NX-API; the NX-API feature is disabled by default.
- CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 — Improper validation of IP traffic. These three are exploitable through crafted packets sent to an IP interface and require NGOAM to be enabled.
- CVE-2026-76465 — Improper validation of MPLS echo-request packets allows exploitation via a crafted request sent to an affected device’s IP address; MPLS OAM must be explicitly activated (it is disabled by default). Nexus 9000 switches with Silicon One ASICs do not support the feature and are therefore unaffected by this flaw.
- Additional constraints: CVE-2026-76486 also requires either Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay to be enabled. “NV Overlay also requires a VXLAN Ethernet VPN (EVPN) VXLAN Network Identifier (VNI) mapped to a Network Virtualization Endpoint (NVE) interface with at least one peer VXLAN Tunnel Endpoint (VTEP) learned (for example, BGP EVPN or an ingress-replication static peer),” reads Cisco’s advisory. CVE-2026-76501 is exploitable if SRv6 — supported only on some Nexus 9000 models — is turned on.
Cisco's mitigations: upgrades, configuration changes, and temporary shields
Cisco recommends upgrading NX-OS releases to fixed versions, which administrators can identify with the vendor’s Software Checker tool. Where upgrades and reboots are not immediately possible, Cisco is offering temporary Live Protect shields for all five flaws; this protection system is intended for switches that cannot yet be upgraded and rebooted.
The company also advises disabling NGOAM, NX-API, or MPLS OAM features if they are not needed, thereby eliminating the relevant attack vectors. Cisco states that all five vulnerabilities were discovered during internal security testing and that it was unaware of public announcements or malicious exploitation at the time the advisories were published.
Related hardening updates for Cisco License (formerly Smart Software Manager)
Separately, Cisco released security hardening updates for Cisco License (formerly Smart Software Manager). The fixes address four issues spanning missing authentication for critical functions (CVE-2026-76480, CVSS 9.8), improper cryptographic signature verification (CVE-2026-76482, CVSS 10.0), insufficiently protected credentials (CVE-2026-76483, CVSS 9.1), and code injection (CVE-2026-76484, CVSS 8.8). Affected releases are vulnerable regardless of configuration; Cisco recommends upgrading to version 10-202609. Older releases branded as Smart Software Manager will not receive a patch for these flaws, and Cisco recommends migrating to a supported release in those cases.
How technologists, procurement leaders, and network operators should act
- Technologists and security teams: Identify Nexus 3000 and 9000 devices running standalone NX-OS, confirm whether NX-API, NGOAM, or MPLS OAM are enabled, and use Cisco’s Software Checker to find fixed NX-OS builds. If immediate upgrades are impossible, deploy Cisco’s Live Protect shields and disable unneeded features.
- Procurement and asset managers: Verify whether existing Nexus 9000 models support SRv6 or use Silicon One ASICs (the latter affects CVE-2026-76465 applicability) and ensure device inventories capture operating modes (standalone NX-OS versus ACI mode) since ACI-mode devices are not affected by these five flaws.
- Network operators and on-call teams: Plan maintenance windows for NX-OS upgrades and reboots where needed, and prioritize devices with enabled NGOAM, NX-API, or MPLS OAM; treat devices that cannot be upgraded as candidates for immediate mitigation via disabling features or applying Live Protect shields.
Cisco has published the advisories and tools referenced above and urges operators to remediate promptly. For the complete advisory and technical details, see the original Cisco report linked below.
