Cisco has released security advisories addressing five critical vulnerabilities residing in its NX-OS data center network operating system. These flaws create pathways for attackers to execute arbitrary code with root-level access on Nexus switches. When remote code execution proves infeasible, threat actors could instead leverage these issues to terminate processes and trigger device reloads, resulting in service disruption.

The vulnerabilities target the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features present in Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode. Exploitation requires at least one of these three features to be operational on the targeted device.

Vulnerability breakdown

All five flaws stem from validation failures. The specific vulnerabilities and their exploitation requirements are:

  • CVE-2026-76471: Insufficient input validation exploitable via crafted HTTP requests to NX-API, which remains disabled by default.
  • CVE-2026-76485, CVE-2026-76486, CVE-2026-76501: Improper IP traffic validation exploitable through crafted packets sent to an IP interface; all three demand NGOAM to be enabled.
  • CVE-2026-76486 (additional requirement): Also requires either Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay to be active.
  • CVE-2026-76465: Improper validation of MPLS echo-request packets; exploitable through crafted requests sent to an affected device's IP address. MPLS OAM must be explicitly enabled, as it is disabled by default.

Regarding CVE-2026-76486, Cisco's advisory states: "NV Overlay also requires a VXLAN Ethernet VPN (EVPN) VXLAN Network Identifier (VNI) mapped to a Network Virtualization Endpoint (NVE) interface with at least one peer VXLAN Tunnel Endpoint (VTEP) learned (for example, BGP EVPN or an ingress-replication static peer)."

CVE-2026-76501 becomes exploitable when SRv6 is enabled, though this feature is supported only on certain Nexus 9000 models. Nexus 9000 switches equipped with Silicon One ASICs do not support MPLS OAM and remain unaffected by CVE-2026-76465.

Nexus 7000 switches and Nexus 9000 switches running in ACI mode are not vulnerable to any of these five flaws.

Remediation guidance

Cisco advises upgrading NX-OS to patched versions, which can be identified using the vendor's Software Checker tool. As an interim measure, organizations should disable NGOAM, NX-API, or MPLS OAM features if they are not operationally necessary, thereby removing the attack surface.

For switches unable to be upgraded and rebooted immediately, Cisco offers temporary Live Protect shields covering all five vulnerabilities. These shields provide protection until permanent patches can be deployed.

Cisco discovered all five vulnerabilities through internal security testing and reported no awareness of public disclosure or active exploitation at the time of advisory publication.

Separate Cisco License vulnerabilities

Beyond the Nexus issues, Cisco released security hardening updates for Cisco License, formerly known as Smart Software Manager. Four distinct flaws were addressed:

  • CVE-2026-76480 (CVSS 9.8): Missing authentication for critical functions
  • CVE-2026-76482 (CVSS 10.0): Improper cryptographic signature verification
  • CVE-2026-76483 (CVSS 9.1): Insufficiently protected credentials
  • CVE-2026-76484 (CVSS 8.8): Code injection

These License vulnerabilities affect systems regardless of configuration. Cisco recommends upgrading to version 10-202609, with no available workarounds. Older releases still branded as Smart Software Manager will not receive patches for these issues; Cisco instead recommends migration to a currently supported release.