Cisco NX-OS NX-API Vulnerability Enables Critical Remote Code Execution

Cisco Discloses Critical NX-OS NX-API Vulnerability

Cisco has disclosed a critical security vulnerability in the NX-API feature of Cisco NX-OS Software that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial-of-service condition.

Tracked as CVE-2026-76471, the vulnerability has a CVSS base score of 9.8, placing it in the Critical severity category. Cisco published the advisory on October 7, 2026.

The issue is associated with insufficient input validation of data sent to NX-API. According to Cisco, an attacker could exploit the vulnerability by sending a specially crafted HTTP request to the NX-API interface of an affected device.

Cisco has released software updates addressing the vulnerability and says there are no workarounds that fully address the issue.

At a Glance

Source: Cisco Security Advisory.

What Is CVE-2026-76471?

CVE-2026-76471 affects the NX-API feature in Cisco NX-OS Software.

Cisco says the vulnerability results from insufficient input validation for information submitted to NX-API. An attacker can send a crafted HTTP request to the affected interface, potentially triggering arbitrary code execution.

The potential impact is significant because successful exploitation could provide root-level code execution on an affected device. Cisco also states that exploitation could cause process crashes, potentially resulting in a device reload and denial of service.

The advisory identifies the vulnerability as CWE-122, which relates to heap-based buffer overflow conditions.

Which Cisco Products Are Affected?

Cisco says the vulnerability affects specific products when they are running a vulnerable release of Cisco NX-OS Software and have NX-API enabled.

Affected products include:

• Cisco Nexus 3000 Series Switches

• Cisco Nexus 9000 Series Switches operating in standalone NX-OS mode

• Cisco UCS 6300 Series Fabric Interconnects

There is an important distinction between the affected platforms.

For Cisco Nexus 3000 and 9000 Series Switches, the NX-API feature is disabled by default. The critical unauthenticated remote attack described by Cisco therefore depends on the feature being enabled on the affected device.

For Cisco UCS 6300 Series Fabric Interconnects, exploitation requires valid low-privileged user credentials and occurs through the Cisco UCS Manager XML API. Cisco says that this API is enabled by default and cannot be disabled without loss of functionality. Because authentication is required in this case, Cisco reduces the Security Impact Rating to High for the UCS 6300 Series Fabric Interconnects.

How to Check Whether NX-API Is Enabled

Cisco provides a direct NX-OS command for checking the NX-API status on Nexus 3000 and 9000 Series Switches.

Administrators can use:

show feature | include nxapi

Cisco provides the following example when NX-API is enabled:

switch# show feature | include nxapi
    nxapi                  1          enabled

This check can help network teams identify whether a potentially affected Nexus switch has the relevant feature enabled.

The presence of NX-API alone does not determine whether a particular software release is vulnerable. Cisco advises customers to use its Software Checker to determine the affected release and the appropriate fixed release.

Cisco Products Confirmed Not Vulnerable

Cisco also lists several product families that are not affected by CVE-2026-76471.

These include:

• Firepower 1000 Series

• Firepower 2100 Series

• Firepower 4100 Series

• Firepower 9300 Series

• MDS 9000 Series Multilayer Switches

• Nexus 7000 Series Switches

• Nexus 9000 Series Fabric Switches operating in ACI mode

• Secure Firewall 200 Series

• Secure Firewall 1200 Series

• Secure Firewall 3100 Series

• Secure Firewall 4200 Series

• Secure Firewall 6100 Series

• UCS 6400 Series Fabric Interconnects

• UCS 6500 Series Fabric Interconnects

• UCS 6600 Series Fabric Interconnects

• UCS X-Series Direct Fabric Interconnect 9108 100G

Organizations should still verify their specific hardware and software configuration against Cisco's advisory rather than relying only on the product family name.

No Full Workaround Is Available

Cisco states that there are no workarounds that address the vulnerability.

However, Cisco has released a Live Protect shield for CVE-2026-76471 as a temporary mitigation for Cisco NX-OS Software. Cisco describes Live Protect shields as temporary measures intended to bridge the gap until software updates can be scheduled.

Cisco continues to recommend upgrading to a fixed software release as the remediation path.

This distinction is important for security teams. A temporary mitigation should not be treated as an equivalent replacement for the vendor-provided software fix.

Cisco Recommends Upgrading to Fixed Software

Cisco recommends that customers upgrade affected systems to the fixed software identified in its advisory.

For Cisco NX-OS Software, the company directs administrators to its Cisco Software Checker, which can identify whether a particular software release is affected and determine the earliest release containing the relevant fix. The tool can also identify a combined first-fixed release when multiple advisories affect a software version.

For UCS 6300 Series Fabric Interconnects, Cisco provides the following fixed-release information:

Cisco states that its PSIRT validates only the affected and fixed release information documented in the advisory.

Cisco Reports No Known Malicious Exploitation

At the time of publication, Cisco's Product Security Incident Response Team said it was not aware of public announcements or malicious use of CVE-2026-76471.

That does not reduce the need for remediation. The vulnerability carries a 9.8 CVSS score and can potentially provide remote code execution with root privileges under the affected Nexus configuration.

Cisco says the vulnerability was discovered through internal security testing.

What Security Teams Should Do

Organisations running Cisco Nexus infrastructure should first establish whether the affected feature and software configuration apply to their environment.

A practical response can include:

1. Identify affected hardware.
   Check whether the environment contains Nexus 3000, Nexus 9000 in standalone NX-OS mode, or UCS 6300 Series Fabric Interconnects.

2. Check the software release.
   Use Cisco's Software Checker to determine whether the installed release is affected.

3. Check NX-API configuration.
   On relevant Nexus switches, use the Cisco-provided command to determine whether NX-API is enabled.

4. Assess exposure.
   Review how the NX-API interface is reachable within the organisation's network architecture.

5. Apply the Cisco mitigation if required.
   Cisco's Live Protect shield can provide temporary protection while remediation is scheduled.

6. Upgrade to a fixed release.
   Cisco identifies software updates as the permanent remediation path.

7. Continue monitoring Cisco advisories.
   The CVE was disclosed as part of Cisco's October 7, 2026 security advisory publication cycle, which includes multiple NX-OS security issues.

Why This Vulnerability Matters

The combination of remote reachability, a lack of authentication for the affected Nexus NX-API scenario, and potential root-level code execution makes CVE-2026-76471 particularly important for network security teams.

Network infrastructure is often treated as a foundational security layer because switches and fabric components connect large portions of an organisation's computing environment. A vulnerability that can potentially lead to privileged code execution on a network device therefore deserves rapid assessment.

The announcement also highlights a broader industry shift toward treating network infrastructure vulnerabilities as operational security issues rather than isolated software defects.

For enterprises, this could mean closer coordination between network operations, infrastructure engineering and security teams when critical network-device vulnerabilities are disclosed.

Cisco's October Security Disclosure Includes Other NX-OS Issues

CVE-2026-76471 was not the only NX-OS vulnerability disclosed by Cisco on October 7.

Cisco's advance notification lists several other NX-OS vulnerabilities published during the same advisory cycle, including vulnerabilities affecting MPLS OAM, NGOAM, endpoint group contracts, the control plane and the Python sandbox.

Among them, Cisco lists the following as Critical:

• NX-OS Security Hardening Release vulnerabilities

• Nexus 3000 and 9000 MPLS OAM Remote Code Execution Vulnerability

• Nexus 3000 and 9000 NGOAM Remote Code Execution Vulnerabilities

• NX-OS NX-API Remote Code Execution Vulnerability, CVE-2026-76471

This broader release means organisations managing Cisco NX-OS infrastructure may need to evaluate more than one advisory when planning their remediation cycle.

The Bottom Line

Cisco's disclosure of CVE-2026-76471 adds a critical NX-OS vulnerability to the security workload for organisations operating affected Nexus and UCS infrastructure.

The vulnerability can potentially allow arbitrary code execution with root privileges or trigger denial-of-service conditions. Cisco has released updates, provides a temporary Live Protect shield, and states that no full workaround is available.

Cisco has not reported known malicious exploitation at the time of publication. Nevertheless, organisations using affected configurations should verify their exposure and follow Cisco's recommended upgrade path.