Cisco NX-OS Software: Improper input validation in command processing
Summary
Cisco NX-OS Software on Nexus, MDS 9000 and UCS fabric interconnect platforms is affected by an improper input validation flaw (CWE-20) in the command handling. Cisco has not disclosed the specific bug. The CVSS score of 8.6 indicates that a remote attacker without credentials or user interaction could cause a high availability impact, with a scope change. Cisco reports no known exploitation and no workarounds, and the flaw is part of a bundled security hardening release from October 2026.
Affected
- Cisco NX-OS Software on MDS 9000, Nexus 3000, Nexus 7000 and Nexus 9000 (standalone and ACI mode)
- Cisco UCS Managed fabric interconnects (6300, 6400, 6500, 6600 and 9108 100G series)
- The exact affected release list is not confirmed for this CVE; the advisory excerpts are inconsistent. Check Cisco's advisory.
Fixed in
Unknown for this CVE. Cisco's advisory contains a per-platform Fixed Software table, but it could not be verified against this CVE. Third-party sources list 10.3(10), 10.4(8), 10.5(6) and 10.6(4) for standalone Nexus 3000/9000, but these are unverified. For MDS 9000 release 9.3 and earlier, Cisco advises migrating to a fixed release.
Workaround
No workarounds available.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof-of-concept found.
Our recommendation
- Inventory all Cisco NX-OS, MDS and UCS devices and their software versions.
- Confirm the affected releases and the fixed release for each platform in Cisco's advisory.
- Schedule upgrades to the fixed releases Cisco specifies.
- Restrict management access to these devices (ACLs, management VRF, jump hosts) and monitor for unusual device behaviour until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory: NX-OS Software Security Hardening Release, October 2026 sec.cloudapps.cisco.com
- Cisco Security Advisory (cisco.com mirror) www.cisco.com
- Cisco Nexus 9000 security advisories list www.cisco.com
- OpenCVE CVE-2026-76456 app.opencve.io
- Third-party analysis of the NX-OS hardening release (unverified) zerohunt.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:14.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used in a command issue that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.