Cisco warns of critical flaws allowing Nexus switch takeover

What did Cisco warn about in its Nexus switch security advisories?

Cisco disclosed five critical vulnerabilities in NX-OS, the operating system used by affected Nexus data center switches. The flaws could allow remote attackers to execute arbitrary code with root privileges. That level of access could give an attacker powerful control over a switch. Even without code execution, exploitation could disrupt network availability.

The vulnerabilities affect NX-API, Next Generation OAM, and MPLS OAM paths. For example, CVE-2026-76471 can be triggered by a crafted HTTP request sent through NX-API. Other flaws use crafted IP traffic or MPLS echo-request packets. Each weakness involves inadequate validation of incoming data.

Cisco recommends upgrading to fixed NX-OS releases identified by its Software Checker. Administrators should disable unnecessary NX-API, NGOAM, or MPLS OAM features. Cisco also supplied temporary Live Protect shields for switches that cannot yet be upgraded and rebooted. Cisco said it knew of no public exploitation when it published the advisories.

What are NX-OS and Nexus switches, and what role do they play in a data center network?

NX-OS is Cisco’s network operating system for its Nexus switching platform. Nexus switches are purpose-built for data center networks. They forward traffic between servers, storage systems, applications, and other network devices. In standalone NX-OS mode, the operating system also provides management and operations features such as NX-API and OAM tools.

The advisories concern Nexus 3000 and Nexus 9000 Series switches. A switch in this role may process management requests, diagnostic messages, and specialized network packets. The vulnerabilities arise when those processing paths fail to validate incoming data correctly. An attacker can then send specially crafted traffic to a reachable device or interface.

This matters because a compromised switch can affect network connectivity and availability. Cisco states that exploitation could run arbitrary code with root privileges or crash processes and reload the device. Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected by these five flaws.

How many vulnerabilities were disclosed, which Nexus models are affected, and how many features can expose them?

The disclosure covers five NX-OS vulnerabilities. They affect Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode. The affected feature families are NX-API, Next Generation OAM, and MPLS OAM. A vulnerability becomes relevant when its associated feature is active on the device.

CVE-2026-76471 targets NX-API through a crafted HTTP request. CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 involve crafted IP traffic and require NGOAM. CVE-2026-76465 involves crafted MPLS echo-request packets and requires MPLS OAM. CVE-2026-76486 also needs SRv6 or NV Overlay, while CVE-2026-76501 requires SRv6.

NX-API is disabled by default, and MPLS OAM must be explicitly enabled. Nexus 7000 switches and Nexus 9000 devices running ACI mode are excluded. Silicon One-based Nexus 9000 switches do not support MPLS OAM and are unaffected by CVE-2026-76465.

What could happen if an attacker successfully exploits one of these flaws?

The most severe possible result is arbitrary code execution with root privileges. In practical terms, that could give an attacker extensive control over the affected switch. The article also describes a second outcome: exploitation may crash processes and force the device to reload. That creates a denial-of-service condition even when code execution is not achieved.

The attack method depends on the flaw and enabled feature. A crafted HTTP request can target NX-API. Crafted IP packets can target NGOAM-related processing. A crafted MPLS echo-request packet can target MPLS OAM. These inputs exploit failures to validate data correctly before the switch processes it.

The operational impact can therefore range from compromise to temporary loss of network service. Cisco discovered the flaws during internal security testing and reported no known public announcements or malicious exploitation when publishing. Upgrading, disabling unused features, and applying Live Protect shields can reduce exposure while remediation proceeds.

Why do features such as NX-API, NGOAM, MPLS OAM, SRv6, and NV Overlay determine whether a switch is vulnerable?

The features act as entry points for the vulnerable processing code. If a feature is inactive, the corresponding request or packet path is unavailable, so that specific attack condition cannot succeed. Cisco says every flaw requires at least one relevant feature to be active. NX-API is the path for one crafted HTTP request, while NGOAM and MPLS OAM handle other traffic types.

CVE-2026-76471 requires NX-API, which is disabled by default. Three vulnerabilities require NGOAM. CVE-2026-76465 requires MPLS OAM, which must be explicitly activated. CVE-2026-76486 additionally requires SRv6 or NV Overlay. CVE-2026-76501 requires SRv6, supported only on some Nexus 9000 models.

NV Overlay has its own conditions. Cisco says it requires an EVPN VNI mapped to an NVE interface with at least one learned VTEP peer. These dependencies narrow exposure, but enabled features still create attack paths. Disabling unnecessary services removes those paths.

What can administrators do to reduce the risk if they cannot immediately upgrade and reboot their switches?

The quickest risk reduction is to disable features that the network does not need. Cisco specifically recommends disabling NGOAM, NX-API, or MPLS OAM when they are unused. Because exploitation depends on these features being active, removing an unnecessary feature can eliminate the corresponding attack vector without waiting for a maintenance window.

For example, NX-API is disabled by default, while MPLS OAM must be explicitly activated. An administrator can review configuration and turn off either service if operational requirements do not depend on it. NGOAM should likewise be disabled where it is not needed. These steps reduce exposure but do not replace a software fix when the feature is required.

Cisco recommends upgrading to fixed NX-OS releases identified through its Software Checker. For devices that cannot yet be upgraded and rebooted, Cisco supplies temporary Live Protect shields for all five vulnerabilities. Cisco reported no known exploitation at publication.

What is input validation, and why is it essential for protecting network devices from malicious packets and requests?

Input validation is the process of checking data before a system accepts or processes it. A network device may receive HTTP requests, IP packets, or protocol messages from many sources. Validation helps confirm that each input follows the expected structure and contains safe values. It is essential because malformed data can trigger unexpected behavior in software.

The Cisco flaws show the risk clearly. CVE-2026-76471 involves insufficient validation of an HTTP request through NX-API. Other vulnerabilities involve improper validation of IP traffic or MPLS echo-request packets. An attacker can craft these inputs to reach vulnerable code. The result may be arbitrary code execution with root privileges or process crashes and device reloads.

Strong validation reduces the chance that hostile data will control program behavior. It should be combined with secure configuration, software updates, and disabling unnecessary services. Cisco’s advisories demonstrate that even specialized management and diagnostic features can become attack paths when validation fails.

Key Facts:

📌 Five critical NX-OS vulnerabilities affect certain Nexus switches.

📌 Successful attacks could execute code with root privileges.

📌 Cisco recommends upgrades, feature disabling, and temporary Live Protect shields.

📌 NX-OS is Cisco’s operating system for Nexus data center switches.

📌 Nexus switches connect and manage traffic inside data center networks.

📌 The advisories cover Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode.

📌 Cisco disclosed five vulnerabilities in total.