Cisco NX-OS vulnerabilities October 2026 include multiple critical security issues affecting Cisco Nexus data-center switches. Several of these vulnerabilities have received a CVSS score of 9.8 and could allow attackers to execute arbitrary code or cause denial-of-service conditions.

The October 2026 security disclosure includes vulnerabilities affecting features such as NX-API, Next Generation OAM (NGOAM), MPLS OAM, as well as several vulnerabilities addressed through Cisco’s NX-OS Security Hardening Release.

Several of these vulnerabilities have received a CVSS Base Score of 9.8 (Critical) and, depending on the affected feature and configuration, could allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial-of-service condition.

Cisco published these advisories on October 7, 2026. At the time of publication, Cisco’s Product Security Incident Response Team (PSIRT) said it was not aware of malicious exploitation of the disclosed vulnerabilities.

For network administrators managing Cisco Nexus infrastructure, this is an advisory that should not be ignored.

Network infrastructure security does not exist in isolation. Understanding how Ethernet works can help administrators better understand the underlying network architecture and potential attack surfaces.

Cisco NX-OS vulnerabilities disclosed in October 2026, including critical CVSS 9.8 security issues.

Cisco NX-OS Vulnerabilities October 2026: What Happened?

Cisco published several critical NX-OS security advisories as part of its October 7, 2026 disclosure cycle.

The most important CVEs include:

CVE	Component / Issue	Severity
CVE-2026-76471	NX-API Remote Code Execution	CVSS 9.8 Critical
CVE-2026-76465	MPLS OAM Remote Code Execution	CVSS 9.8 Critical
CVE-2026-76485	NGOAM vulnerability	CVSS 9.8 Critical
CVE-2026-76486	NGOAM vulnerability	CVSS 9.8 Critical
CVE-2026-76501	NGOAM vulnerability	CVSS 9.8 Critical
CVE-2026-76455	NX-OS Security Hardening / access control	CVSS 9.8 Critical
CVE-2026-76459	NX-OS Security Hardening / out-of-bounds write	CVSS 9.8 Critical

Cisco’s October NX-OS security hardening advisory groups six vulnerabilities under different vulnerability classes. Two of them, CVE-2026-76455 and CVE-2026-76459, have a maximum CVSS score of 9.8.

The separate NGOAM advisory covers three vulnerabilities, all with a CVSS score of 9.8.

Cisco also disclosed CVE-2026-76471 in NX-API and CVE-2026-76465 in MPLS OAM, both rated 9.8 Critical.

1. CVE-2026-76471 — NX-API Remote Code Execution

One of the most concerning vulnerabilities affects the NX-API feature in Cisco NX-OS.

Cisco assigned this vulnerability:

CVE: CVE-2026-76471
CVSS: 9.8 Critical
CWE: CWE-122 — Heap-based Buffer Overflow

The vulnerability is caused by insufficient validation of data sent to NX-API.

An attacker could send a specially crafted HTTP request to the NX-API interface. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

The attack could also cause process crashes and potentially reload the affected switch, resulting in a denial-of-service condition.

Why Network Administrators Should Care

NX-API is designed to provide programmatic management and automation capabilities for Cisco Nexus switches.

If NX-API is exposed to an untrusted or insufficiently restricted network, the attack surface becomes particularly important.

Administrators should therefore identify Nexus switches where NX-API is enabled and determine whether those systems are running a vulnerable NX-OS release.

Cisco states that there is no workaround that fully addresses the vulnerability. Cisco has released a temporary Live Protect Shield, but recommends upgrading to a fixed software release.

2. CVE-2026-76465 — MPLS OAM Remote Code Execution

Another critical vulnerability affects the MPLS OAM feature.

CVE: CVE-2026-76465
CVSS: 9.8 Critical

The vulnerability affects Cisco Nexus 3000 Series switches and Nexus 9000 Series switches operating in standalone NX-OS mode when the MPLS OAM feature is enabled.

The important point is that MPLS OAM is disabled by default on the affected Nexus platforms.

Administrators can check the feature status using:

show feature | include mpls_oam

If the feature is enabled, the administrator should evaluate whether it is actually required.

Cisco states that disabling MPLS OAM removes the attack vector when the feature is not required:

configure terminal
no feature mpls oam

However, this should only be performed after confirming that MPLS OAM is not required by the production network.

Cisco has also released a Live Protect Shield for CVE-2026-76465, but the recommended long-term remediation remains upgrading to a fixed NX-OS release.

3. Three Critical NGOAM Vulnerabilities

Cisco has also disclosed three critical vulnerabilities in the Next Generation Operation, Administration, and Maintenance (NGOAM) functionality of NX-OS.

The affected CVEs are:

CVE-2026-76485
CVE-2026-76486
CVE-2026-76501

All three vulnerabilities have a CVSS Base Score of 9.8.

According to Cisco, successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial-of-service condition.

The vulnerabilities affect Cisco Nexus 3000 and Nexus 9000 Series switches running standalone NX-OS, but the exact exposure depends on the features enabled on the switch.

CVE-2026-76485

This vulnerability requires NGOAM to be enabled.

Administrators can check NGOAM status with:

show feature | include ngoam

If NGOAM is not required, disabling the feature can remove the attack vector.

configure terminal
no feature ngoam

Again, administrators should first verify whether NGOAM functionality is required in their environment.

CVE-2026-76486

This vulnerability has additional configuration requirements involving NGOAM and either Segment Routing over IPv6 (SRv6) or certain Network Virtualization Overlay (NVO) configurations.

This means that simply checking the software version may not be enough.

Network administrators should also review the configuration and enabled features of the Nexus switch.

CVE-2026-76501

The third NGOAM vulnerability requires NGOAM and SRv6 functionality.

Cisco notes that Nexus 3000 switches do not support SRv6, while SRv6 support exists only on certain Nexus 9000 platforms.

Therefore, administrators need to evaluate the actual hardware model and configuration rather than assuming that every Nexus switch is equally exposed.

4. Cisco NX-OS Security Hardening Release

Cisco’s October 2026 NX-OS Security Hardening Release addresses six vulnerability classes:

CVE	Maximum CVSS	Vulnerability Class
CVE-2026-76453	8.8	Improper neutralization
CVE-2026-76455	9.8	Improper access control
CVE-2026-76456	8.6	Improper input validation
CVE-2026-76457	8.6	Out-of-bounds read
CVE-2026-76458	8.6	Improper handling of exceptional conditions
CVE-2026-76459	9.8	Out-of-bounds write

Cisco says these vulnerabilities were discovered during internal security testing and were not known to be actively exploited when the advisory was published.

Unlike some feature-specific vulnerabilities, these hardening issues can affect devices based on the vulnerable software release regardless of device configuration.

Which Cisco Devices Are Affected?

The October NX-OS security hardening advisory lists several Cisco platforms, including:

Cisco Nexus 3000 Series
Cisco Nexus 7000 Series
Cisco Nexus 9000 Series in standalone NX-OS mode
Cisco Nexus 9000 Series Fabric Switches in ACI mode
Cisco MDS 9000 Series
Cisco UCS 6300 Series Fabric Interconnects
Cisco UCS 6400 Series Fabric Interconnects
Cisco UCS 6500 Series Fabric Interconnects
Cisco UCS 6600 Series Fabric Interconnects
Cisco UCS X-Series Direct Fabric Interconnect 9108 100G

The exact affected releases depend on the specific advisory and platform.

Administrators should review Cisco NX-OS vulnerabilities October 2026 against their specific Nexus platform and software release.

Fixed NX-OS Releases

For the October 2026 Security Hardening Release, Cisco lists the following first fixed releases for major Nexus platforms:

Platform	Affected Release	First Fixed Release
Nexus 3000 / Nexus 9000 Standalone	10.3 and earlier	10.3(10)
Nexus 3000 / Nexus 9000 Standalone	10.4	10.4(8)
Nexus 3000 / Nexus 9000 Standalone	10.5	10.5(6)
Nexus 3000 / Nexus 9000 Standalone	10.6	10.6(4)
Nexus 7000	8.4	8.4(14)
Nexus 9000 ACI	16.0 and earlier	16.0(9h)
Nexus 9000 ACI	16.1	16.1(6g)
Nexus 9000 ACI	16.2	16.2(3g)

Cisco specifically recommends checking the applicable advisory and platform before selecting a target release.

Do not blindly upgrade every Nexus switch to the same NX-OS version. Platform, boot mode, hardware support, features and existing production requirements must be considered.

How to Check Your Cisco Nexus Switch

Before planning remediation, collect the following information.

Check NX-OS Version

show version

Look for:

NXOS: version

Example:

NXOS: version 10.4(7)

Check Enabled Features

For NGOAM:

show feature | include ngoam

For MPLS OAM:

show feature | include mpls_oam

For NVE:

show feature | include nve

For NX-API:

show feature | include nxapi

Administrators should also review the relevant running configuration before disabling any production feature.

Why CVSS 9.8 Is Serious

A CVSS score of 9.8 corresponds to a Critical severity vulnerability with the following characteristics in these advisories:

Network-based attack
Low attack complexity
No privileges required
No user interaction required
High confidentiality impact
High integrity impact
High availability impact

For example, the CVSS vector reported by Cisco for the NGOAM vulnerabilities is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

That combination is particularly concerning for network infrastructure because an attacker may not need valid credentials or interaction from a network administrator to attempt exploitation.

These Cisco NX-OS vulnerabilities October 2026 should be addressed according to Cisco’s recommended fixed releases.

What Should Network Administrators Do?

1. Inventory All Nexus Devices

Create an inventory containing:

Device hostname
Model
Serial number
NX-OS version
Standalone NX-OS or ACI mode
Enabled features
Management IP
Internet/DMZ exposure
Maintenance window
Backup status

This is especially important in large data-center environments where dozens or hundreds of Nexus switches may exist.

Network administrators should review their Cisco NX-OS vulnerabilities October 2026 exposure based on the Nexus platform, NX-OS release and enabled features.

2. Check the Cisco Software Checker

Cisco provides the Cisco Software Checker to identify security advisories affecting a particular software release and determine the appropriate fixed release.

Administrators should use the Software Checker instead of relying only on a generic “latest NX-OS version” approach.

Cisco Software Checker / Security Advisories

3. Upgrade to a Fixed Release

Cisco’s primary recommendation is to upgrade affected devices to a fixed software release.

Before upgrading production Nexus switches:

Back up the running configuration.
Verify bootflash/storage capacity.
Check release compatibility.
Review Cisco release notes.
Verify hardware support.
Check feature compatibility.
Test in a lab where possible.
Schedule a maintenance window.
Confirm redundancy/failover behavior.
Validate routing and forwarding after the upgrade.

4. Disable Unnecessary Features

If immediate software upgrades are not possible, review whether vulnerable features are actually required.

For example:

show feature | include ngoam

and:

show feature | include mpls_oam

If MPLS OAM or NGOAM is not required, disabling the feature may reduce exposure for the corresponding vulnerability.

However, Cisco emphasizes that such mitigations should be evaluated against the operational requirements of the network.

The Cisco NX-OS vulnerabilities October 2026 disclosure highlights why regular NX-OS security reviews are important for enterprise networks.

Do Not Expose Nexus Management Interfaces to the Internet

These vulnerabilities reinforce a fundamental network-security principle:

Management interfaces should never be unnecessarily exposed to the public Internet.

Network administrators should use:

Dedicated management VLANs
Out-of-band management where possible
Management VRFs
Access Control Lists
Firewall policies
SSH instead of insecure management protocols
Restricted administrative source IPs
MFA through appropriate management infrastructure
Network segmentation

Even when a vulnerability is described as “remote,” limiting who can reach the affected service significantly reduces the practical attack surface.

Is Cisco Aware of Active Exploitation?

At the time Cisco published the October 7, 2026 advisories, Cisco PSIRT stated that it was not aware of public announcements or malicious use of the vulnerabilities covered by these advisories.

However, this should not be interpreted as “safe to wait.”

Network infrastructure devices are high-value targets. A critical unauthenticated RCE vulnerability in a core or data-center switch can potentially provide an attacker with a powerful position inside the network.

How These Vulnerabilities Could Affect a Data Center

Consider a simplified data-center environment:

                 Internet
                    |
               Firewall
                    |
             Core / Border
                    |
             Cisco Nexus 9000
              /           \
             /             \
       Server Network    Storage
             |
       Virtualization

If an attacker successfully compromises a Nexus switch running critical infrastructure services, the impact could extend beyond the switch itself.

Potential consequences include:

Network disruption
Device reloads
Traffic interception
Network segmentation bypass
Lateral movement
Service availability problems
Data-center outages
Loss of network visibility
Potential compromise of connected infrastructure

The actual impact depends on the vulnerable feature, configuration and network architecture.

Security Checklist for Cisco NX-OS Administrators

Before closing the security ticket, verify:

All Nexus switches have been inventoried.
NX-OS versions have been collected.
Cisco Software Checker has been consulted.
NX-API status has been checked.
NGOAM status has been checked.
MPLS OAM status has been checked.
SRv6/NVE configuration has been reviewed where applicable.
Running configurations have been backed up.
Fixed NX-OS release has been selected.
Maintenance window has been approved.
Upgrade has been completed.
Routing has been validated.
VLANs and SVIs have been validated.
BGP/OSPF/ISIS status has been checked where applicable.
vPC/MLAG status has been checked.
Monitoring/NMS has been verified.
Logs have been reviewed after the upgrade.

Final Takeaway

The October 2026 Cisco NX-OS security disclosure is significant for network administrators because multiple vulnerabilities carry a CVSS score of 9.8, including vulnerabilities affecting NX-API, MPLS OAM and NGOAM.

The most serious scenarios involve unauthenticated remote attackers potentially executing arbitrary code with root privileges or causing device reloads and denial-of-service conditions.

The correct response is not simply to check whether a Nexus switch is running.

Administrators should determine:

Which platform → Which NX-OS version → Which vulnerable feature → Which configuration → Which fixed release → Which maintenance window.

If you operate Cisco Nexus infrastructure, review the October 2026 Cisco advisories now and plan the upgrade to the appropriate fixed release.

For production environments, always validate the target NX-OS release against the exact hardware model, feature set and Cisco’s official Software Checker before deployment.

Network administrators should also keep track of major enterprise security updates such as the Microsoft September 2026 Patch Tuesday release.

The Cisco NX-OS vulnerabilities October 2026 disclosure highlights the importance of keeping Nexus infrastructure updated.

Official Cisco References

Cisco NX-OS Software Security Hardening Release — October 2026

Cisco NX-OS Security Hardening Advisory

Cisco NX-API Remote Code Execution — CVE-2026-76471

Cisco NX-API Security Advisory

Cisco Nexus NGOAM Vulnerabilities — CVE-2026-76485, CVE-2026-76486, CVE-2026-76501

Cisco NGOAM Security Advisory

Cisco Nexus MPLS OAM — CVE-2026-76465

Cisco MPLS OAM Security Advisory

For readers who want to understand the networking fundamentals behind these security issues, you can internally link this article to your existing Zyqren content:

How Ethernet Works — useful for readers who want to understand how data moves through Layer 2 networks.

Microsoft September 2026 Patch Tuesday — useful as a broader enterprise-security reference for administrators managing network and Windows infrastructure.

These internal links can help strengthen the topical relationship between Networking, Infrastructure and Cybersecurity content on Zyqren.

Critical Cisco NX-OS Vulnerabilities October 2026: CVSS 9.8 Security Alert

Table of Contents