Cisco NX-OS: critical flaws in Nexus 3000 and 9000, and more

📌 Later developments: Cisco: critical RCE in Expressway, Unified CM and Snort 3 flaws (October 21, 2026) · Cisco NX-API flaw CVE-2026-76471 also hits UCS 6300 (October 13, 2026)

On 7 October 2026 Cisco published a new batch of security advisories. According to SecurityWeek the fixes cover 35 vulnerabilities, more than a dozen of them critical, across NX-OS, Cisco License, APIC, Meraki and Finesse. The most relevant case for data centres concerns Nexus 3000 and 9000 switches: BleepingComputer reports five critical vulnerabilities that, in certain configurations, allow code execution as root on the switch.

The story is reported by two outlets, BleepingComputer and SecurityWeek: in what follows, each piece of information is attributed to its source. Neither gives CVSS scores for the NX-OS flaws, which should be checked in Cisco’s advisories. According to both, Cisco was not aware of any exploitation; BleepingComputer says the NX-OS flaws were found in internal testing.

NX-OS: five critical flaws in Nexus 3000 and 9000

According to BleepingComputer, all five vulnerabilities stem from insufficient validation of received data and affect Nexus 3000 and 9000 switches in standalone NX-OS mode, only if at least one of three features is enabled: NX-API, Next Generation OAM (NGOAM) or MPLS OAM. If code execution fails, an attacker can still crash processes and force the switch to reload.

• CVE-2026-76471: a crafted HTTP request to NX-API, which is disabled by default.
• CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501: crafted packets sent to an IP interface, with NGOAM enabled. CVE-2026-76486 also requires SRv6 or NV Overlay (a VXLAN EVPN VNI mapped to an NVE interface, with at least one remote VTEP learned); CVE-2026-76501 requires SRv6, supported only on some Nexus 9000 models.
• CVE-2026-76465: crafted MPLS echo-request packets sent to an IP address of the switch. MPLS OAM is disabled by default; Nexus 9000 switches with Silicon One ASICs do not support it and are not affected.

Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected.

SecurityWeek specifies that CVE-2026-76471 and CVE-2026-76465 can be exploited remotely and without authentication. The sources differ on the count: BleepingComputer lists five critical NX-OS flaws, while according to SecurityWeek NX-OS received 14 fixes, seven of them critical, adding CVE-2026-76455 and CVE-2026-76459, which group improper access control and out-of-bounds write flaws. These two CVEs are mentioned only by SecurityWeek.

In MITRE ATT&CK terms, exploitation falls under T1190 (Exploit Public-Facing Application) and, for the forced reload, T1499.004 (Endpoint Denial of Service: Application or System Exploitation). The sources report no indicators of compromise.

Cisco License, APIC, Meraki and Finesse

• Cisco License (formerly Smart Software Manager). BleepingComputer lists CVE-2026-76480 (missing authentication for a critical function, CVSS 9.8), CVE-2026-76482 (improper verification of cryptographic signature, CVSS 10.0), CVE-2026-76483 (insufficiently protected credentials, CVSS 9.1) and CVE-2026-76484 (code injection, CVSS 8.8): affected releases are vulnerable regardless of configuration, there are no workarounds and the fix is in 10-202609; older Smart Software Manager releases will not be patched and must be migrated. SecurityWeek refers to License On-Prem, with five critical CVEs: the first three plus CVE-2026-20328 (unauthorised access) and CVE-2026-76454 (denial of service), both exploitable without authentication. CVE-2026-76484 appears only in BleepingComputer, the other two only in SecurityWeek.
• APIC, according to SecurityWeek: three critical CVEs (CVE-2026-76498, -76499 and -76500) covering improper access control, OS command injection and memory flaws.
• Meraki, according to SecurityWeek: a hardening release with seven CVEs; the most severe, CVE-2026-76464, covers buffer overflows and out-of-bounds writes.
• Finesse, according to SecurityWeek: a high-severity, publicly disclosed SSRF, CVE-2026-20362.

Impact for European and Italian organisations

Nexus 3000 and 9000 switches are found in the data centres of enterprises, cloud and hosting providers and telecom operators. The conditions described, such as NGOAM with SRv6 or with NV Overlay on VXLAN EVPN, are typical of data centre fabrics and provider networks: that is where to check first. A switch taken over with root privileges, or forced to reload repeatedly, can bring down an entire data centre segment.

For NIS2 entities, especially in digital infrastructure and managed services, this falls under vulnerability management with documented priorities and timelines; a significant disruption caused by an attack must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). In healthcare, a reload of a core switch makes clinical applications unreachable.

What to do now

1. Take inventory of Nexus 3000 and 9000 switches, with NX-OS release (show version) and mode (standalone or ACI).
2. Check enabled features with show running-config | include feature: look for NX-API, NGOAM, MPLS OAM, NV Overlay and SRv6.
3. Disable NX-API, NGOAM and MPLS OAM where not needed: this is Cisco’s recommendation as reported by BleepingComputer.
4. Upgrade NX-OS to the release indicated by Cisco Software Checker, starting with switches whose NX-API is reachable and fabrics with NGOAM. If you cannot reload right away, according to BleepingComputer Cisco offers temporary Live Protect shields for all five flaws.
5. Restrict access to management interfaces, starting with NX-API, using a separate management network and access lists: general good practice, not a substitute for upgrading.
6. Watch for unexpected reloads, process crashes and anomalous HTTP requests to NX-API, sending switch logs to an external system.
7. Upgrade Cisco License to 10-202609, plan the migration of older installations and check Cisco’s advisories for APIC, Meraki and Finesse.

How ARXDOME helps

ARX Sentry collects firewall and network device logs in a central collector: unexpected reloads and process crashes stay recorded outside the switch and are easier to reconstruct. ARX Expose shows which services your company exposes on the Internet and which have known vulnerabilities, so you can check that a management interface such as NX-API is not reachable from outside.

Last updated: 8 October 2026