Cisco Nexus Flaws Could Allow Root Access to Switches

Five critical Cisco Nexus flaws could let attackers execute code with root privileges on affected data center switches. Cisco has released security updates to address the vulnerabilities in its NX-OS operating system.

Attackers could also crash processes and trigger device reloads, disrupting network services even when attempts to execute code fail.

However, exposure depends on device configuration. The vulnerabilities affect certain Nexus 3000 and Nexus 9000 switches running standalone NX-OS with specific networking features enabled.

Which Features Expose Nexus Switches?

The five vulnerabilities involve validation failures in NX-API, Next Generation OAM (NGOAM), and MPLS OAM. Each flaw requires its corresponding feature to be active.

The vulnerabilities include:

• CVE-2026-76471: Insufficient input validation in NX-API could allow exploitation through a specially crafted HTTP request. NX-API is disabled by default.
• CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501: Improper validation of IP traffic could allow exploitation through crafted packets. All three require NGOAM.
• CVE-2026-76465: Improper validation of MPLS echo-request packets could allow exploitation through a crafted request targeting the device’s IP address.

Consequently, administrators need to check both their NX-OS release and the features enabled on each switch.

Additional Configuration Requirements Limit Some Attacks

Several Cisco Nexus flaws require more than an active OAM feature.

For example, CVE-2026-76486 also requires either Segment Routing over IPv6 (SRv6) or Network Virtualization Overlay.

The overlay configuration must include a VXLAN EVPN network identifier mapped to a Network Virtualization Endpoint interface. That interface must also have learned at least one peer VXLAN Tunnel Endpoint.

Meanwhile, CVE-2026-76501 requires SRv6, which only certain Nexus 9000 models support.

The MPLS vulnerability, CVE-2026-76465, requires administrators to explicitly enable MPLS OAM because the feature is off by default. Nexus 9000 switches using Silicon One ASICs do not support that feature and therefore avoid this particular flaw.

Cisco also says Nexus 7000 switches and Nexus 9000 switches running in ACI mode are unaffected by all five vulnerabilities.

Updates and Temporary Protections Address the Risks

Cisco recommends upgrading affected devices to a fixed NX-OS release. Administrators can use its Software Checker tool to identify the appropriate update.

In addition, disabling unnecessary NX-API, NGOAM, or MPLS OAM features removes the corresponding attack vector.

For switches that cannot immediately undergo an upgrade and reboot, Cisco offers temporary Live Protect shields covering all five vulnerabilities.

Cisco discovered the issues during internal security testing. At the time it published the advisories, the company knew of no public disclosures or malicious exploitation.

Cisco License Also Receives Security Fixes

Separately, Cisco released security hardening updates for Cisco License, previously known as Smart Software Manager.

These updates address four additional vulnerabilities:

• CVE-2026-76480: Missing authentication for critical functions, with a CVSS score of 9.8.
• CVE-2026-76482: Improper cryptographic signature verification, with a CVSS score of 10.0.
• CVE-2026-76483: Insufficient protection of credentials, with a CVSS score of 9.1.
• CVE-2026-76484: Code injection, with a CVSS score of 8.8.

Unlike the Nexus issues, these vulnerabilities affect vulnerable releases regardless of configuration. Cisco recommends upgrading to version 10-202609, as no workarounds are available.

However, older releases carrying the Smart Software Manager name will not receive patches. Organizations using those versions must migrate to a supported release to obtain the fixes.