CVE-2026-76471
CriticalCVSS 9.8Summary
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a DoS condition. It is due to insufficient input validation of data sent to the NX-API.
Risk Assessment
An attacker could gain full control of the device or cause it to crash and reload, potentially disrupting network operations.
Recommendation
Apply Cisco NX-OS software updates provided by the vendor and restrict access to NX-API to trusted hosts only.
Other vulnerabilities in Cisco NX-OS Software
See all- CVE-2026-20173Medium
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition. The issue exists because rate limiting was improperly applied to some protocols. An attacker could exploit this by sending a high rate of UDP or TCP connections to a data plane interface, leading to instability in routing and control plane protocols.
- CVE-2026-20032Medium
A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system. The issue is due to insufficient validation of user-supplied input. An attacker could manipulate specific functions within the Python interpreter to execute arbitrary commands on the operating system with the privileges of the authenticated user.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76465Critical
A vulnerability in the MPLS OAM feature of Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a DoS condition. It is due to improper validation of MPLS echo-request packets.
- CVE-2026-76455Critical
The Cisco NX-OS team discovered vulnerabilities related to improper access control (CWE-284) during an internal security review. They were addressed in a hardening release.
Original NVD description (English source)
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS