Cisco fixes critical remote code flaws in Nexus switch software

Cisco fixes critical remote code flaws in Nexus switch software

7 October 2026: Cisco has published software updates for two unauthenticated remote code execution flaws in NX-OS, the operating system of its Nexus data centre switches. Both advisories carry a CVSS score of 9.8, both let an attacker run code as root or crash the device, and Cisco says its incident response team knows of no public announcement or malicious use of either.

The advisories came out on 7 October as part of a larger release. Italy's national cybersecurity agency counts 35 Cisco vulnerabilities fixed that day, 15 of them rated critical.

The NX-API flaw

CVE-2026-76471 sits in the NX-API feature and comes from insufficient input validation. A specially crafted HTTP request is enough to trigger it. Affected products are Nexus 3000 Series and Nexus 9000 Series switches in standalone mode, plus UCS 6300 Series Fabric Interconnects. NX-API is off by default on the Nexus switches but on by default on the UCS 6300 interconnects, so the interconnects are the devices most likely to be exposed without anyone having chosen it. Cisco lists no workaround.

The NGOAM flaws

Three CVEs, CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501, affect the Next Generation OAM feature on Nexus 3000 and 9000 switches in standalone NX-OS mode. Crafted packets trigger them. The first applies whenever NGOAM is enabled. The second also needs SRv6 or an NV overlay with VXLAN EVPN, and the third needs SRv6.

Cisco states there is no workaround. It does describe two stopgaps: switching the feature off with the command no feature ngoam, or deploying a Live Protect shield until the patch is installed. A Live Protect shield is also offered for the NX-API flaw.

Finding the fixed release

Both advisories direct customers to the Cisco Software Checker, which names the first fixed release for a given platform and software version. A switch estate usually mixes several NX-OS trains, so each device needs its own lookup rather than one version number for the fleet.

Company profile on TrustList: Cisco

Related on TrustList:

• CISA gives agencies until 1 November for GitLab and Cisco ASA flaws
• Cisco License On-Prem flaw lets anyone reset admin passwords

Sources

• Cisco: NX-OS Software NX-API Remote Code Execution Vulnerability (cisco-sa-napi-rce-r2shwu2j), 7 October 2026
• Cisco: Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities (cisco-sa-ngoam-rce-LWKQ4BU), 7 October 2026
• Italy ACN: Aggiornamenti di sicurezza per prodotti Cisco, 7 October 2026