Cisco NX-OS: Denial of service via improper handling of exceptional conditions
Summary
CVE-2026-76458 is part of Cisco's October 2026 NX-OS security hardening advisory and affects Nexus 3000, 7000 and 9000 switches, MDS 9000 switches and UCS Fabric Interconnects, depending on the software release. The weakness (CWE-703) concerns uncaught exceptions and reachable assertions, which can be triggered to disrupt affected devices. The CVSS vector requires no privileges or user interaction over the network, but only the availability impact is rated high. Cisco reports no known exploitation and no workarounds.
Affected
- Cisco NX-OS Software on MDS 9000, Nexus 3000, Nexus 7000 and Nexus 9000 (standalone NX-OS mode)
- Cisco NX-OS System Software in ACI mode (Nexus 9000 Fabric Switches)
- Cisco UCS Fabric Interconnects (UCS 6300, 6400, 6500, 6600 and 9108 100G)
- Per-release affected scope for this specific CVE is not fully confirmed; check the advisory tables.
Fixed in
Unknown for this CVE. Cisco lists first fixed releases per product family in the Fixed Software section of the advisory. Unverified third-party data should not be used for upgrade planning.
Workaround
- Cisco states that no workarounds are available for this advisory.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC assessment: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Inventory all NX-OS and UCS fabric devices and their running releases now.
- Confirm the fixed release for each platform in the Cisco advisory and plan an upgrade in a maintenance window.
- Restrict management access (SSH, NX-API, SNMP) to dedicated admin networks and block exposure from untrusted networks.
- Monitor devices for unexpected crashes or reloads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory: NX-OS Software Security Hardening Release, October 2026 sec.cloudapps.cisco.com
- Cisco Security Advisory (mirror, cisco.com) www.cisco.com
- OpenCVE entry CVE-2026-76458 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:13.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76458 are related to improper handling of exceptional conditions issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.