Critical Flaws in Cisco Nexus Switches Leave Devices Vulnerable to Takeover
Cisco has issued a warning about five critical vulnerabilities in its NX-OS data center network operating system that could allow an attacker to take control of Nexus switches. The issues, discovered during internal security testing, affect the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features in Nexus 3000 and Nexus 9000 Series switches.
The vulnerabilities, identified as CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, and CVE-2026-76465, can be exploited through various means, including crafted HTTP requests, IP traffic packets, and MPLS echo-request packets. In some cases, additional features such as Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay must be enabled for the vulnerabilities to be exploitable.
The issues impact Nexus 3000 and Nexus 9000 Series switches in standalone NX-OS mode. However, successful exploitation depends on the NX-API, Next Generation OAM (NGOAM), and MPLS OAM features being active. The vendor notes that Nexus 7000 switches and Nexus 9000 switches operating in ACI mode are not affected by any of the five vulnerabilities.
Cisco recommends upgrading NX-OS releases to a fixed version as soon as possible, as can be identified through the vendor’s Software Checker tool. In the meantime, disabling NGOAM, NX-API, or MPLS OAM features if not needed is also recommended to eliminate the attack vector. For devices that cannot yet be upgraded and rebooted, Cisco provides temporary Live Protect shields for all five flaws.
It’s worth noting that these vulnerabilities were discovered during internal security testing, and Cisco states it was unaware of public announcements or malicious exploitation at the time of publishing the advisories. This highlights the importance of regular security testing and vulnerability assessment in preventing potential attacks.
In addition to addressing the Nexus switch vulnerabilities, Cisco also released security hardening updates for Cisco License (formerly Smart Software Manager) that address various issues, including missing authentication, improper cryptographic signature verification, insufficiently protected credentials, and code injection. Affected releases are vulnerable regardless of configuration, and Cisco recommends upgrading to version 10-202609, with no workarounds available.
The takeaway from this alert is clear: Nexus switch owners must act quickly to mitigate the risk of these vulnerabilities being exploited. Upgrading to a fixed version or disabling unnecessary features can go a long way in protecting against potential attacks. As the threat landscape continues to evolve, it’s essential for organizations to prioritize regular security testing and patching to ensure their infrastructure remains secure.
Source: Bleeping Computer — 2026-10-08