Five Critical Cisco Nexus Switch Flaws on One Page: A Spec Sheet and NX-OS Patch Checklist

Cisco has released advisories for five critical vulnerabilities in NX-OS, the operating system on its Nexus data center switches. In the worst case an attacker could run code as root on the switch. If that fails, the same bugs can crash processes and force a reload, knocking the switch offline. Whether you are exposed depends heavily on which features you have turned on.

The specifics below are drawn from Bill Toulas’s write-up at BleepingComputer.

Spec sheet

• Affected hardware: Nexus 3000 and Nexus 9000 Series switches in standalone NX-OS mode
• Not affected: Nexus 7000 switches and Nexus 9000 switches in ACI mode
• Root cause: Validation failures in all five cases
• Features involved: NX-API, Next Generation OAM (NGOAM) and MPLS OAM. At least one must be enabled for any of the flaws to apply.
• CVE-2026-76471: A crafted HTTP request to NX-API. NX-API is off by default.
• CVE-2026-76485, CVE-2026-76486, CVE-2026-76501: Crafted packets to an IP interface, all requiring NGOAM. CVE-2026-76486 also needs Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay. CVE-2026-76501 needs SRv6, which only some Nexus 9000 models support.
• CVE-2026-76465: Crafted MPLS echo-request packets. MPLS OAM is off by default, and Nexus 9000 switches with Silicon One ASICs don’t support it, so they are not affected.
• Discovery: Cisco’s own internal testing. Cisco says it knew of no public disclosure or malicious use when it published.
• Fix: Upgrade to a fixed NX-OS release, identified with Cisco’s Software Checker
• Stopgap: Temporary Live Protect shields for all five flaws, for switches that can’t be upgraded and rebooted yet

Also in this batch: Cisco License

Cisco also patched Cisco License, formerly Smart Software Manager, with four serious flaws: missing authentication for critical functions (CVE-2026-76480, CVSS 9.8), improper cryptographic signature verification (CVE-2026-76482, CVSS 10.0), insufficiently protected credentials (CVE-2026-76483, CVSS 9.1) and code injection (CVE-2026-76484, CVSS 8.8). These apply regardless of configuration and there are no workarounds. The fix is version 10-202609. Older releases still branded Smart Software Manager won’t get a patch, so Cisco says to move to a supported release.

Patch checklist

1. List every Nexus 3000 and 9000 switch and note whether it runs standalone NX-OS or ACI mode.
2. On each standalone switch, check whether NX-API, NGOAM, MPLS OAM, SRv6 or NV Overlay is enabled.
3. Run your NX-OS versions through Cisco’s Software Checker to find the fixed release.
4. If a feature isn’t needed, turn it off. Cisco recommends this to remove the attack path entirely.
5. Where you can’t schedule an upgrade and reboot yet, look at the Live Protect shields as a temporary measure.
6. Separately, upgrade Cisco License to 10-202609, and plan a migration for any old Smart Software Manager installs.
7. Keep management interfaces such as NX-API on a restricted management network, not open to user or internet traffic.

What this means for your company

Smaller businesses rarely buy Nexus switches themselves, but their colocation provider, hosting company or MSP data center often does. Switches like these tend to go years without updates because nobody wants to schedule the downtime. Ask your providers whether these advisories apply to them and when they will patch.

• Keep a hardware and firmware inventory for your own network gear, not just servers and PCs.
• Turn off features you don’t use. In this case several of the bugs only matter when a non-default feature is on.
• Book a recurring maintenance window so network patches don’t wait for an emergency.

Need help reviewing your network equipment, or setting up a patch routine that covers switches and firewalls too? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.

About The Author

L7 News

See author's posts