Cisco Patches Five Critical NX-OS Flaws Affecting Nexus Switches

Summary

Cisco patched five critical NX-OS flaws that can enable unauthenticated remote code execution or denial of service on configured Nexus switches. No active exploitation was confirmed as of October 9, 2026.

Key points

The five vulnerabilities affect NX-API, NGOAM, and MPLS OAM on Nexus 3000 and Nexus 9000 switches running standalone NX-OS.
The flaws carry CVSS 3.1 scores of 9.8 and can cause root-level code execution, process crashes, or device reloads when required features are enabled.
NX-API and MPLS OAM are disabled by default; exposure to several flaws depends on NGOAM, SRv6, or NV Overlay configuration.
Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected. UCS 6300 Fabric Interconnects are also affected by CVE-2026-76471, but exploitation requires valid low-privileged credentials.
Cisco recommends upgrading to fixed releases and provides temporary Live Protect shields; defenders should disable unneeded features and review relevant activity for suspicious events.
Cisco reported no known public announcements or malicious use of the vulnerabilities as of October 9, 2026.

Article Details

Vulnerability Types: Heap-based buffer overflow
Stack-based buffer overflow
Improper validation
Severity: CVSS 3.1: 9.8 for all five vulnerabilities; Cisco rates CVE-2026-76471 High for UCS 6300 because exploitation requires valid low-privileged credentials.
Exploitation Status: not_reported
Exploit Availability: none_reported
Patch Status: available
Workarounds: Disable NX-API if it is not required.
Disable NGOAM with `no feature ngoam` if it is not required.
Disable MPLS OAM with `no feature mpls oam` if it is not required.
Review whether SRv6, NV Overlay, VXLAN EVPN, and NVE configurations are necessary.