Cisco Patches Critical NX-OS Flaw Enabling Remote Root Code Execution

Summary

Cisco patched critical CVE-2026-76471, a flaw in NX-API affecting certain Nexus switches and UCS 6300 fabric interconnects. Exploitation can enable root-level code execution or device reloads; exposure depends on access and platform configuration.

Key points

The heap-based buffer overflow has a CVSS score of 9.8 and can allow remote code execution with root privileges or cause a device to reload.
On Nexus 3000 and 9000 switches in standalone NX-OS mode, exploitation requires NX-API to be enabled and reachable; the interface is disabled by default.
On UCS 6300 Series Fabric Interconnects, the flaw affects the UCS Manager XML API, which is enabled by default; exploitation requires valid low-privileged credentials.
Cisco released security updates on October 7, 2026. UCS Software 4.3 is fixed in version 4.3(6j); UCS 6300 systems on 4.2 or earlier require migration to a fixed release.
Cisco recommends upgrading affected devices, disabling NX-API when unnecessary, and restricting management-interface access to approved systems.
Cisco's Live Protect shield is identified as a temporary control where supported; monitor for unexpected API requests, crashes, reloads, configuration changes, and privileged activity.

Article Details

Vulnerability Types: Heap-based buffer overflow
Severity: Critical (CVSS 9.8); High for UCS 6300 deployments
Affected Versions: UCS Software 4.2 or earlier
Exploitation Status: unknown
Exploit Availability: unknown
Patch Status: available
Workarounds: Disable NX-API where operational workflows do not require it.
Limit access to NX-API and UCS management interfaces to approved administrative and automation systems.
Apply Cisco’s Live Protect shield where supported as a temporary control.