Cisco's October NX-OS hardening release fixes six CVEs across Nexus, MDS, ACI and UCS, two scored 9.8. AI-assisted testing found them; there is no workaround.
Cisco published a security hardening release for NX-OS on 7 October 2026 that fixes six vulnerabilities across its data-centre switching line. Two score CVSS 9.8, and the advisory's headline vector is network-reachable, low complexity, with no privileges and no user interaction. There are no workarounds. Cisco says it is not aware of public announcements or malicious use.
What makes the release notable is where the bugs came from. Cisco says they were found during internal testing "using existing testing processes as well as frontier AI models". The advisory credits Cisco's own NX-OS engineering team and names no outside researcher.
Who is affected
Any device running a vulnerable NX-OS release is affected, regardless of configuration:
- MDS 9000 Series Multilayer Switches
- Nexus 3000 and Nexus 7000 Series Switches
- Nexus 9000 Series in standalone NX-OS mode and in ACI mode
- UCS 6300, 6400, 6500 and 6600 Series Fabric Interconnects
- UCS X-Series Direct Fabric Interconnect 9108 100G
Every vulnerable NX-OS release is affected, whatever its configuration. Older trains have no fix and must migrate.
The six CVEs
Cisco grouped the issues by weakness class and assigned one CVE to each class. The page gives a single vector for the advisory, and each score below is the highest in its class, so the 9.8 figures should not be read as two confirmed unauthenticated bugs without checking Cisco's per-issue detail.
| CVE | CVSS | Class |
|---|---|---|
| CVE-2026-76453 | 8.8 | CWE-707, command, OS and argument injection |
| CVE-2026-76455 | 9.8 | CWE-284, improper access control, including authentication bypass |
| CVE-2026-76456 | 8.6 | CWE-20, input validation, including path traversal |
| CVE-2026-76457 | 8.6 | CWE-125, out-of-bounds read |
| CVE-2026-76458 | 8.6 | CWE-703, improper handling of exceptional conditions |
| CVE-2026-76459 | 9.8 | CWE-787, out-of-bounds write, including buffer overflows |
Because the CVEs cover whole classes, each may stand for several individual bugs. Cisco lists no bug IDs on the advisory. It does reference Snort rules 67191, 67192 and 67188.
Fixed releases
- MDS 9000: 9.4(5a); 9.3 and earlier must migrate
- Nexus 3000 and 9000 (standalone): 10.3(10), 10.4(8), 10.5(6), 10.6(4); 10.3 and earlier trains must migrate to a fixed release
- Nexus 7000: 8.4(14); 8.3 and earlier must migrate
- Nexus 9000 in ACI mode: 16.0(9h), 16.1(6g), 16.2(3g)
- UCS Manager: 4.3(6j) or 6.0(2e); 4.2 and earlier must migrate
- UCS Intersight Managed Mode: 4.3(6.260049), 4.3(6.260059) for the 9108 100G only, or 6.0(2.260080)
Why it matters
Network operating systems are long-lived, memory-unsafe codebases with a history of pre-authentication bugs. Cisco's own earlier NX-OS advisory, NGOAM, MPLS OAM and NX-API flaws including CVE-2026-76485, shows the same attack surface. Here a vendor used frontier models on its own code and shipped fixes before any exploitation was reported. Attackers can run the same tools against the same binaries, so the gap between a fix and a working exploit may narrow.
What defenders should do
- Inventory NX-OS, ACI and UCS fabric interconnect versions and map each to the fixed release above. Plan migrations for trains with no fix.
- Patch first where management and data-plane interfaces are reachable from untrusted networks.
- Since no workaround exists, restrict management-plane access to trusted hosts as general hygiene while patching.
- Review the Snort rules Cisco lists and watch for anomalous management-plane crashes or reloads.
- Note that the Canadian Cyber Centre's AV26-1020 bulletin of 8 October covers a wider Cisco batch (Meraki, APIC, License On-Prem, Finesse, CCE and CCX) with fix dates running to early 2027.