Critical Validation Flaws in Cisco Nexus Switches Enable Remote Code Execution and Denial‑of‑Service
What Happened – Cisco disclosed five critical CVEs (CVE‑2026‑76471, CVE‑2026‑76485, CVE‑2026‑76486, CVE‑2026‑76465, CVE‑2026‑76501) in the NX‑OS operating system for Nexus 3000 and Nexus 9000 series switches. The flaws stem from insufficient input validation in NX‑API, Next‑Generation OAM, and MPLS OAM features, allowing an attacker with those features enabled to execute arbitrary code with root privileges or trigger a denial‑of‑service reload.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that detect, assess, and remediate critical flaws before they become exploitable.
- Highlights the importance of configuration‑control evidence (feature enablement, patch status) to prove a defensible audit trail.
- Aligns with the control‑mapping objective of maintaining up‑to‑date evidence across frameworks, supporting continuous assurance and audit readiness.
Who Is Affected – Data‑center operators, cloud service providers, and enterprises that deploy Cisco Nexus 3000/9000 switches in standalone NX‑OS mode.
Recommended Actions – Verify whether NX‑API, NGOAM, or MPLS OAM are enabled; disable any unnecessary features; apply the Cisco‑provided NX‑OS patches via the Software Checker; capture configuration and patch‑state evidence for audit purposes. Source: https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-flaws-allowing-nexus-switch-takeover/
Technical Notes –
- CVE‑2026‑76471: crafted HTTP request to NX‑API (disabled by default).
- CVE‑2026‑76485/86486/76501: crafted IP packets exploiting NGOAM validation; some require SRv6 or Network Virtualization overlay.
- CVE‑2026‑76465: malformed MPLS echo‑request packets when MPLS OAM is active.
- Exploitation can lead to remote code execution (root) or forced device reload (DoS). Source: Cisco advisory