Cisco warns of five critical flaws that could let attackers take over Nexus switches
Summary
Cisco disclosed five critical NX-OS flaws that could enable root-level code execution or denial of service on some Nexus switches, plus four Cisco License flaws. It recommends upgrades and disabling affected features when unnecessary.
Key points
- Five NX-OS vulnerabilities affect Nexus 3000 and 9000 switches in standalone mode; exploitation requires relevant NX-API, NGOAM, or MPLS OAM features to be active.
- The flaws could allow arbitrary code execution with root privileges; if that is unsuccessful, attackers could crash processes and force a device reload.
- Cisco says Nexus 7000 switches and Nexus 9000 switches running in ACI mode are not affected. Some flaws also require additional features such as SRv6 or NV Overlay.
- Cisco recommends upgrading to fixed NX-OS releases, disabling affected features if they are not needed, and offers temporary Live Protect shields for switches awaiting upgrades.
- Cisco reported no public announcements or malicious exploitation of the five Nexus flaws when it published the advisories.
- Four additional Cisco License vulnerabilities include missing authentication, signature-verification weaknesses, exposed credentials, and code injection; Cisco recommends upgrading to version 10-202609, with no workarounds available.
Article Details
- Vulnerability Types
- Insufficient input validation
- Improper validation of IP traffic
- Improper validation of MPLS echo-request packets
- Missing authentication for critical functions
- Improper cryptographic signature verification
- Insufficiently protected credentials
- Code injection
- Severity
- The five switch vulnerabilities are critical. The licensing vulnerabilities have reported CVSS scores of 9.8, 10.0, 9.1, and 8.8.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Disable NGOAM, NX-API, or MPLS OAM when not needed to eliminate the corresponding switch attack vectors.
- Apply the vendor's temporary protection shields for the five switch flaws when devices cannot yet be upgraded and rebooted.
CVE
CVE-2026-76465CVE-2026-76465: Improper validation of MPLS echo-request packets allows exploitation through a crafted request sent to an affected device’s IP address.CVE-2026-76471CVE-2026-76471: Insufficient input validation; it can be exploited through a crafted HTTP request sent to the NX-API, a feature that is disabled by default.CVE-2026-76480The issues span missing authentication for critical functions (CVE-2026-76480, CVSS 9.8), improper cryptographic signature verification (CVE-2026-76482, CVSS 10.0), insufficiently protected credentials (CVE-2026-76483,CVE-2026-76482for critical functions (CVE-2026-76480, CVSS 9.8), improper cryptographic signature verification (CVE-2026-76482, CVSS 10.0), insufficiently protected credentials (CVE-2026-76483, CVSS 9.1), and code injectionCVE-2026-76483signature verification (CVE-2026-76482, CVSS 10.0), insufficiently protected credentials (CVE-2026-76483, CVSS 9.1), and code injection (CVE-2026-76484, CVSS 8.8).CVE-2026-76484CVSS 10.0), insufficiently protected credentials (CVE-2026-76483, CVSS 9.1), and code injection (CVE-2026-76484, CVSS 8.8).CVE-2026-76485CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501: Improper validation of IP traffic can be exploited through crafted packets sent to an IP interface; all three require NGOAM to be enabled.CVE-2026-76486CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501: Improper validation of IP traffic can be exploited through crafted packets sent to an IP interface; all three require NGOAM to be enabled.CVE-2026-76501CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501: Improper validation of IP traffic can be exploited through crafted packets sent to an IP interface; all three require NGOAM to be enabled.
Vendors
Products
Cisco LicenseIn addition to the five Nexus flaws Cisco addressed this time, the security and networking firm also released security hardening updates for Cisco License (formerly Smart Software Manager).Live ProtectCisco also provides temporary Live Protect shields for all five flaws, which is a protection system for switches that cannot yet be upgraded and rebooted.Nexus 3000The issues affect the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features in Nexus 3000 and Nexus 9000 Series switches.Nexus 7000The vendor notes that Nexus 7000 switches and Nexus 9000 switches operating in ACI mode are not affected by any of the five vulnerabilities.Nexus 9000The issues affect the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features in Nexus 3000 and Nexus 9000 Series switches.NX-OSCisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches.Smart Software ManagerIn addition to the five Nexus flaws Cisco addressed this time, the security and networking firm also released security hardening updates for Cisco License (formerly Smart Software Manager).