Cisco NX-OS: Improper neutralization (injection) in hardening release

Summary

Cisco NX-OS software on Nexus 3000, 7000 and 9000 switches (standalone and ACI mode), MDS 9000 switches and UCS Fabric Interconnects contains improper neutralization flaws (CWE-707, covering command, OS and argument injection). Cisco found them in an internal security review and rates the CVE at CVSS 8.8 (high). Per the CVSS vector, an attacker needs network access and low privileges, and no user interaction, and could affect confidentiality, integrity and availability. Cisco reports no known exploitation and no workarounds.

Affected

• Cisco NX-OS releases listed as vulnerable in the Fixed Releases table of the Cisco advisory, regardless of device configuration.
• Nexus 3000 and standalone Nexus 9000 (NX-OS mode): releases 10.3 and earlier, and the 10.4, 10.5 and 10.6 trains before the fixed releases below.
• MDS 9000: 9.3 and earlier.
• Nexus 7000: 8.3 and earlier.
• Nexus 9000 in ACI mode: 16.0 to 16.2 releases before the fixed releases below.
• UCS 6300, 6400, 6500, 6600 and 9108 100G Fabric Interconnects: 4.2 and earlier, and 6.0 releases before the fixed releases below.
• Version data in the CVE record and third-party sources differs from the Cisco advisory; the advisory is authoritative.

Fixed in

• MDS 9000: 9.4(5a)
• Nexus 3000 and standalone Nexus 9000: 10.3(10), 10.4(8), 10.5(6), 10.6(4)
• Nexus 7000: 8.4(14)
• Nexus 9000 in ACI mode: 16.0(9h), 16.1(6g), 16.2(3g)
• UCS Fabric Interconnects (UCS Manager): 4.3(6j), 6.0(2e)
• UCS Fabric Interconnects (Intersight Managed Mode): 4.3(6.260049), 4.3(6.260059) for 9108 100G only, 6.0(2.260080)
• Use the Fixed Software table in the Cisco advisory to confirm the release for each platform.

Workaround

No workarounds available. Cisco states that patching is the only remedy.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• Cisco CISA SSVC assessment: exploitation none, not automatable, total technical impact.
• CISA KEV listing and public proof-of-concept code: not verified.

Our recommendation

• Inventory all NX-OS devices (model, NX-OS release and whether ACI mode is used).
• Schedule upgrades to the fixed releases in the Cisco advisory table for each platform.
• Restrict management access to trusted administration networks and limit accounts with login rights.
• Review accounts and monitor for unexpected configuration changes until patched.
• Check the separate critical NX-API flaw CVE-2026-76471 in the same bundle first if NX-API is enabled.
• Re-check KEV and exploit sources before the next review.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-nxosw1-cWzSbtR sec.cloudapps.cisco.com
• Cisco Security Advisory (cisco.com copy) www.cisco.com
• OpenCVE entry CVE-2026-76453 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:20.