Cisco NX-OS hardening release: six CVEs, two 9.8 criticals, no workaround

On October 7, 2026 Cisco published a single advisory, Cisco NX-OS Software Security Hardening Release: October 2026, that fixes six vulnerabilities in the operating system that runs the data-center switching fabric — Nexus 3000, 7000 and 9000 switches, MDS 9000 storage directors, and UCS Fabric Interconnects. Two of the six are rated CVSS 9.8. The overall Security Impact Rating is Critical, there are no workarounds, and the only remedy is a software upgrade. Cisco found all six itself, in an internal review, and says none has been used in an attack. That last fact is the reason to move now, not the reason to wait.

Developing story — first published 18:09 CEST (16:09 UTC), October 7, 2026. Updated as the vendor and CISA publish more.

At a glance

CVEs	CVE-2026-76453 · CVE-2026-76455 · CVE-2026-76456 · CVE-2026-76457 · CVE-2026-76458 · CVE-2026-76459 (NVD records not yet published as of 2026-10-07)
Product / affected versions	Cisco NX-OS on MDS 9000 (≤ 9.3) · Nexus 3000/9000 standalone (≤ 10.6) · Nexus 7000 (≤ 8.4) · Nexus 9000 ACI mode (16.0–16.2) · UCS Fabric Interconnects 6300/6400/6500/6600/9108 (≤ 6.0)
Fixed in	MDS 9.4(5a) · Nexus 3000/9000 10.3(10)·10.4(8)·10.5(6)·10.6(4) · Nexus 7000 8.4(14) · ACI 16.0(9h)·16.1(6g)·16.2(3g) · UCS FI 4.3(6j)·6.0(2e)
CVSS	Two at 9.8 Critical (CVE-2026-76455 authorization bypass; CVE-2026-76459 out-of-bounds write) · four at 8.6–8.8 High — scored by Cisco (CNA)
Exploited in the wild	No — "The Cisco PSIRT is not aware of any public announcements or malicious use"
CISA KEV	Not listed (catalog version 2026.10.04)
Public PoC	None public as of 2026-10-07
Official advisory	cisco-sa-hardening-nxosw1-cWzSbtR

What Cisco actually shipped

The advisory bundles six distinct weakness classes, each found during what Cisco describes as "a comprehensive internal security review" by its NX-OS engineering team. The two that matter most:

• CVE-2026-76455 — improper access control (authorization/authentication bypass), CVSS 9.8. Cisco scored the critical pair with a network, no-authentication vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• CVE-2026-76459 — an out-of-bounds write (stack/heap buffer overflow, incorrect buffer-size calculation), CVSS 9.8. Memory-corruption bugs in a switch's control plane are the kind that lead to code execution on the device, not just a crash.

The other four are High-severity: CVE-2026-76453 (command/OS/argument injection, 8.8), CVE-2026-76456 (path traversal, 8.6), CVE-2026-76457 (out-of-bounds read / information exposure, 8.6), and CVE-2026-76458 (reachable assertion → denial of service, 8.6). Cisco did not publish per-CVE CVSS vectors for the High-severity four in the summary, so treat their individual privilege prerequisites as "see the advisory" rather than assuming they are all unauthenticated.

What makes this release awkward is not the scores — it is the surface. NX-OS is the fabric. A Nexus 9000 or an MDS 9000 director is not a web app someone put on the internet by accident; it is the thing every other device trusts. It sits in the core, it is rarely rebooted outside a change window, and it is almost never the target of a penetration test. The management plane of the switch is exactly the place a defender assumes is safe because it is "inside."

Who is exposed — and how to check your version

This spans most of the Cisco data-center portfolio, so the first job is an accurate inventory. On any NX-OS device:

show version | include "system:|NXOS:|kickstart:"
show module

Compare the running release against the fixed versions below. The affected ranges are wide — "10.6 and earlier," "6.0 and earlier" — so the safe assumption is that an un-patched device is affected until a version check proves otherwise.

Platform	Affected	Fixed release
MDS 9000	9.3 and earlier	9.4(5a)
Nexus 3000 / 9000 (standalone NX-OS)	10.3 and earlier through 10.6	10.3(10), 10.4(8), 10.5(6), 10.6(4)
Nexus 7000	8.3 and earlier, 8.4	8.4(14)
Nexus 9000 (ACI mode)	16.0 through 16.2	16.0(9h), 16.1(6g), 16.2(3g)
UCS Fabric Interconnects (6300/6400/6500/6600/9108)	4.2 and earlier through 6.0	4.3(6j), 6.0(2e)

"We're not internet-facing, the Nexus is in the core." — That is precisely the exposure. Lateral access to the management VRF of a core switch is a routine objective once an attacker is inside; a 9.8 authorization bypass on that plane turns a foothold into control of the fabric.

Remediation

No workaround ships with this advisory, so the plan is patch-first with disciplined interim controls. Because these are production switches on change windows, sequencing matters more than speed.

1. Am I affected? Run show version on every NX-OS device and map the running train against the table above. Pull it at scale from your NMS/Ansible inventory rather than box by box — the risk is the switch you forgot you own (an old Nexus 7000 in a remote site, an MDS director in a storage pod).

2. Patch — exact fixed releases. Upgrade to the fixed train for each platform: MDS 9.4(5a), Nexus 3000/9000 standalone 10.3(10) / 10.4(8) / 10.5(6) / 10.6(4) (take the maintenance release on your current train), Nexus 7000 8.4(14), Nexus 9000 ACI mode 16.0(9h) / 16.1(6g) / 16.2(3g), UCS FI 4.3(6j) / 6.0(2e). Confirm image integrity before loading.

3. Can't patch tonight? Shrink the management plane. Until the change window, restrict who can reach NX-OS management at all: lock the mgmt0 interface and any in-band management VRF behind management ACLs and Control Plane Policing (CoPP), allow SSH/API only from a named jump-host range, disable unused management services (NX-API, old SNMP), and enforce AAA with no shared local accounts. These do not fix the bugs; they remove the reachability a network, no-auth 9.8 depends on.

4. Hunt for compromise. There are no published indicators — Cisco found these internally and reports no exploitation — so hunt on behaviour, not IOCs. On a core switch the signals are configuration and access anomalies: unexpected configure sessions, new local users or SSH keys, changes to AAA or ACLs, unexplained copy running-config/image writes, and management-plane connections from hosts that have no business touching it. Ship NX-OS syslog, AAA accounting and config-change events off-box to a SIEM — a compromised switch cannot be trusted to report on itself. Map initial access to T1190 Exploit Public-Facing Application at the management plane, and watch for network-device persistence (modified boot image, rogue config).

5. Eradicate + verify. If you find tampering: rebuild from a known-good image, rotate every credential and key the device held (local accounts, TACACS+/RADIUS secrets, SNMP communities, API tokens), and re-verify the configuration against your golden template after patching — not before.

What we don't know yet

• NVD enrichment. As of 2026-10-07 the six CVE records return no results from the NVD API; independent CVSS scores, vectors and CWE mappings will follow. The scores above are Cisco's.
• Per-CVE attack prerequisites. Cisco published a single critical CVSS vector (network, no auth) but not individual vectors for the four High-severity issues — whether each needs authentication is not yet clear from the summary.
• Exploitation and PoC. None reported and none public today. Memory-corruption and auth-bypass bugs on widely deployed Cisco gear have historically drawn exploit development quickly once patches are out and diffable, so the quiet window is unlikely to last.

The fabric nobody tests

A version table answers one question — which build am I running — and three it does not: is the vulnerable code path actually reachable on my topology and configuration; would the authorization bypass or the buffer overflow actually fire against my device; and did the upgrade truly close the hole or just bump a number. Cisco answered the first for you. The rest is the gap between "patched, per the inventory" and "not exploitable, proven."

That gap is wide here because core switches are the assets an annual or quarterly penetration test skips — too production-critical to poke, too "internal" to prioritize. Cisco closed these six by pointing its own tooling at its own code; the same class of automated analysis is available to whoever wants to study the patch diff. "Not exploited" is the head start, not the all-clear.

This is what an autonomous AI red team is built to close. Zero Hunt runs a 10-agent swarm that treats a Nexus or MDS management plane as an in-scope target: it fingerprints the exact platform and running train, then — because there is no public PoC — writes a per-target proof-of-concept with a local model, backtested in the AI Gym before it ever touches your device, and runs every exploitation step in an ephemeral container with a human in the loop gating anything that could disrupt a live fabric. It runs on-premise on private models — nothing about your core topology leaves the appliance — and a change-triggered campaign re-tests within the hour when a new device appears on the fabric, which is the cadence continuous validation needs and a point-in-time pentest cannot match.

Then there is the question this release forces for anyone running a fleet: six fixes, two of them 9.8, no workaround, across switches you cannot reboot on a whim. Zero Hunt's AI Remediation Advisor ranks what to touch first by real exploitability — KEV status, what the campaign actually proved reachable on your boxes, then CVSS and EPSS — gives the exact fixed release per train with rollout and rollback notes and the management-plane ACL/CoPP controls to hold the line until the window, and then re-verifies the fix with the same proof that demonstrated the exposure, every finding signed at write time for the audit trail. It is the difference between a spreadsheet of versions and an ordered, defensible plan for the week the fabric has to be patched. For the counterpart on Cisco's routing side, see our analysis of the IOS XE hardening release.