Cisco NX-OS Software: Improper access control in security hardening release

Summary

Cisco NX-OS Software on Nexus switches, MDS 9000 switches and UCS Fabric Interconnects contains an improper access control weakness (CWE-284), tracked as one of six CVEs in Cisco's October 2026 hardening advisory. The vendor rates it critical (CVSS 9.8) and describes the flaw as remotely exploitable without privileges or user interaction. Cisco has not published the specific bug and states that no workarounds exist. Cisco reports no known public exploitation or malicious use.

Affected

• Cisco NX-OS Software on MDS 9000 Series Multilayer Switches (9.3 and earlier)
• Cisco NX-OS Software on Nexus 3000 and standalone-mode Nexus 9000 switches (10.3 and earlier, 10.4, 10.5, 10.6 branches)
• Cisco NX-OS Software on Nexus 7000 Series Switches (8.3 and earlier)
• Cisco NX-OS System Software in ACI mode on Nexus 9000 Fabric Switches (16.0 and earlier, 16.1, 16.2 branches)
• Cisco UCS Fabric Interconnects 6300, 6400, 6500, 6600 and UCS X-Series 9108 100G (UCS 4.2 and earlier, 4.3, 6.0 branches)
• Vendor advisory states the vulnerability applies regardless of device configuration.

Fixed in

• MDS 9000: migrate to a fixed release; 9.4(5a) listed as first fixed release for 9.4
• Nexus 7000: 8.4(14)
• Nexus 9000 ACI mode: 16.0(9h), 16.1(6g), 16.2(3g)
• Nexus 3000 and standalone Nexus 9000 (unverified, third-party source): 10.3(10), 10.4(8), 10.5(6), 10.6(4)
• UCS Fabric Interconnects: 4.3(6j) for UCS Manager, 4.3(6.260049) or 4.3(6.260059) for 9108, 6.0(2e) or 6.0(2.260080) for Intersight managed mode; exact UCS fixed releases per platform: check the advisory
• Unknown: fixed builds for older branches not listed above; check the Cisco advisory Fixed Software table.

Workaround

• Cisco states that no workarounds are available.
• Interim measure (not from Cisco): restrict management access (SSH, NX-API, HTTPS, SNMP) to dedicated management VLANs and jump hosts, and block internet exposure of these devices.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• CISA SSVC data: exploitation none, automatable yes, technical impact total.
• No public proof of concept found at time of writing.

Our recommendation

• Check whether any Nexus, MDS or UCS Fabric Interconnect devices are in use, and identify their NX-OS, ACI or UCS software versions.
• Upgrade affected devices to the fixed releases in the Cisco advisory during a maintenance window; plan migration where the release is end-of-life.
• Until patched, restrict management interfaces to trusted management networks and ensure they are not reachable from user, guest or internet networks.
• Monitor logs for unexpected administrative logins or configuration changes.
• Priority: high for affected devices, because no workaround exists.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-nxosw1-cWzSbtR sec.cloudapps.cisco.com
• Cisco Security Advisory (mirror) www.cisco.com
• VulDB CVE-2026-76455 vuldb.com
• CVE metadata (OpenCVE) app.opencve.io
• CVEfeed CVE-2026-76455 cvefeed.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:47.