Cisco NX-OS: Out-of-bounds write in security hardening release

Summary

Cisco NX-OS, the operating system of Nexus, MDS 9000 and UCS Fabric Interconnect devices, contains an out-of-bounds write vulnerability (CWE-787) found in an internal security review. A remote attacker without privileges and without user interaction could exploit it over the network, which may allow a complete compromise of confidentiality, integrity and availability of the device. Cisco states that the vulnerable products are affected regardless of device configuration. The CVE is part of a bundle of six issues in one hardening release.

Affected

• Nexus 3000 and Nexus 9000 Series Switches in standalone NX-OS mode: 10.3 and earlier, 10.4, 10.5, 10.6 (per release)
• Nexus 9000 Series Fabric Switches in ACI mode: 16.0, 16.1, 16.2 (per release)
• Nexus 7000 Series Switches: 8.3 and earlier, 8.4 (affected releases per advisory; 8.4 row to be verified)
• MDS 9000 Series Multilayer Switches: 9.3 and earlier, 9.4
• UCS 6300, 6400, 6500, 6600 Series and UCS X-Series 9108 100G Fabric Interconnects: 4.2 and earlier, 4.3, 6.0
• Cisco NX-OS System Software in ACI Mode: listed releases 15.2(1g) to 15.2(5d) in the CVE record
• Cisco Unified Computing System (Managed): listed releases 4.0(1a) to 4.1(2a) in the CVE record

Fixed in

• Nexus 3000/9000 standalone NX-OS: 10.3(10), 10.4(8), 10.5(6), 10.6(4)
• Nexus 7000: 8.4(14)
• Nexus 9000 ACI mode: 16.0(9h), 16.1(6g), 16.2(3g)
• MDS 9000: 9.4(5a) for 9.4; 9.3 and earlier require migration to a fixed release
• UCS Fabric Interconnects (UCS Manager): 4.3(6j), 4.3(6.260059) for 9108 100G only, 6.0(2e)
• UCS Fabric Interconnects (Intersight): 4.3(6.260049), 4.3(6.260059) for 9108 100G only, 6.0(2.260080)

The fix is per release; applying a fixed release addresses all CVEs of this advisory.

Workaround

• Unknown. Cisco states that no workarounds are available for these vulnerabilities.
• Interim measure (not from Cisco): restrict management access to dedicated management networks and block external access to the devices.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in CISA KEV according to third-party records.
• No public proof of concept known at the time of research.

Our recommendation

• Inventory all Nexus, MDS and UCS Fabric Interconnect devices and their NX-OS versions.
• Plan upgrades to the fixed releases, following the vendor's upgrade paths.
• Restrict management access in the interim and make sure no device management interface is reachable from the internet.
• Monitor for anomalous management traffic until the upgrade is complete.
• Re-check the NVD record and KEV status regularly, as the CVE was still awaiting analysis.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-hardening-nxosw1-cWzSbtR sec.cloudapps.cisco.com
• Cisco Security Advisory (www.cisco.com) www.cisco.com
• OpenCVE CVE-2026-76459 app.opencve.io
• Strix CVE-2026-76459 www.strix.ai
• Vulners RAPID7 CVE-2026-76459 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:46.