Cybersecurity

Cisco Warns of Critical Flaws Allowing Nexus Switch Takeover

Cisco has released critical security advisories regarding five vulnerabilities impacting its NX-OS data center network operating system, which could allow malicious actors to achieve remote code execution with root privileges on affected hardware.

Radwan AbdulhadiEditor and technology writer

Published: October 9, 2026 · Updated: October 9, 2026 · 3 min read

Cisco Warns of Critical Flaws Allowing Nexus Switch Takeover — Image: BleepingComputer

Overview of the NX-OS Vulnerabilities

Cisco has issued security advisories addressing five critical vulnerabilities discovered within its NX-OS data center network operating system. According to details reported by BleepingComputer, these flaws could potentially be exploited to run arbitrary code with root privileges on vulnerable switches, or cause processes to crash and force a device reload leading to a denial-of-service condition.

The issues specifically impact Cisco Nexus 3000 Series and Nexus 9000 Series switches operating in standalone NX-OS mode. However, exploitation relies on the activation of certain features, namely the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features, as all five vulnerabilities stem from input validation failures.

Detailed Breakdown of Affected Features

The identified flaws carry specific conditions for exploitation based on device configuration and active features. For instance, CVE-2026-76471 involves insufficient input validation and can be exploited via a crafted HTTP request sent to the NX-API, which is disabled by default.

Meanwhile, three additional vulnerabilities—CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501—involve improper validation of IP traffic and require NGOAM to be enabled. Specifically, leveraging the CVE-2026-76486 flaw also requires either Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay to be enabled on the system.

Additionally, CVE-2026-76465 stems from improper validation of MPLS echo-request packets, allowing exploitation through a crafted request sent directly to an affected device’s IP address when MPLS OAM is explicitly activated.

Unaffected Models and Vendor Guidance

Cisco has clarified that Nexus 7000 switches and Nexus 9000 switches operating in ACI mode are entirely unaffected by any of the five vulnerabilities. Furthermore, Nexus 9000 switches equipped with Silicon One ASICs do not support MPLS OAM and remain safe from that particular flaw.

To mitigate these security risks, Cisco's advisory suggests upgrading NX-OS releases to a fixed version, which can be identified using the vendor's official tools. Network administrators can also disable NGOAM, NX-API, or MPLS OAM features if they are not actively required, effectively eliminating the corresponding attack vectors.

For switches that cannot be immediately upgraded or rebooted, Cisco offers temporary shields through its protection system designed for continuity.

Additional Security Updates Released

In addition to addressing the five Nexus switch flaws, Cisco also published security hardening updates for Cisco License, formerly known as Smart Software Manager. These secondary issues involve missing authentication for critical functions, improper cryptographic signature verification, insufficiently protected credentials, and code injection vulnerabilities.

Cisco noted that all five NX-OS vulnerabilities were discovered internally during security testing and that there were no public announcements or malicious exploitation detected at the time of publishing. Users seeking a comprehensive overview of all recently published alerts can check out this page for further details.