Cisco NX-OS Software: Remote Code Execution in NX-API

Summary

A critical vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending a crafted HTTP request. It affects Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode and UCS 6300 Series Fabric Interconnects. On Nexus switches, exploitation requires NX-API to be enabled, which is disabled by default. On UCS 6300 devices, the attacker needs valid low-privileged credentials for the UCS Manager XML API.

Affected

• Nexus 3000 Series switches with NX-API enabled (vulnerable NX-OS releases)
• Nexus 9000 Series switches in standalone NX-OS mode with NX-API enabled
• UCS 6300 Series Fabric Interconnects (UCS Manager XML API, low-privileged credentials required)
• CVE record lists NX-OS 9.2(1) to 9.3(4) and UCS Managed 4.0(1a) to 4.1(2a); the Cisco advisory is authoritative

Fixed in

Unknown. Cisco states that fixed software is available; the first fixed release per train must be taken from the Cisco advisory and Software Checker. The advisory was updated on 8 October 2026 (Version 1.1).

Workaround

• Cisco states there are no workarounds for this vulnerability.
• Cisco offers a Live Protect shield as a temporary mitigation until an upgrade is possible; see the Nexus 9000 NX-OS Security Configuration Guide.
• Disable NX-API if it is not required (check with: show feature | include nxapi).

Exploitation

• Cisco reports no public announcements or malicious use.
• Not listed in CISA KEV at the time of research; no public proof of concept found.
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Check whether Nexus 3000/9000 switches (standalone NX-OS) or UCS 6300 Fabric Interconnects are in use.
• Verify whether NX-API is enabled and restrict access to management networks.
• Upgrade to a fixed release listed in the Cisco advisory as soon as possible; use the Live Protect shield until then.
• Monitor management interfaces for unusual HTTP requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-napi-rce-r2shwu2j sec.cloudapps.cisco.com
• Cisco Security Advisory (www.cisco.com mirror) www.cisco.com
• Forkast: Cisco NX-API unauthenticated root RCE forkast.news
• FieldEffect: Cisco critical NX-OS remote code execution fieldeffect.com
• Vulners: Rapid7 entry for CVE-2026-76471 vulners.com
• Strix: CVE-2026-76471 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:44.