The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Cisco disclosed five critical NX-OS vulnerabilities that could let an unauthenticated attacker execute code as root or cause a denial of service on certain Nexus switches. Exposure is conditional: it depends on the switch model and operating mode, a vulnerable software release, and whether the affected feature and any required configuration are enabled. Administrators should check their exact platform and release with Cisco’s Software Checker, then install the fixed release it identifies.
What Cisco disclosed
On October 7, 2026, Cisco published advisories covering five critical vulnerabilities across three NX-OS features: NX-API, Next Generation OAM (NGOAM), and MPLS OAM. The advisories concern Nexus 3000 and Nexus 9000 switches running standalone NX-OS under feature-specific conditions. Cisco rates each vulnerability group CVSS 9.8. That score indicates severity; it is not a victim count or evidence of confirmed exploitation.
The potential outcomes described by Cisco are unauthenticated remote code execution with root privileges or denial of service, including a device reload if affected processes crash. These are possible outcomes when the relevant conditions are met, not a claim that every Nexus switch is exposed or can be taken over. See Cisco’s NX-API advisory, NGOAM advisory, and MPLS OAM advisory.
Which vulnerabilities and features are involved?
| Feature | CVEs | When exposure applies |
|---|---|---|
| NX-API | CVE-2026-76471 | A vulnerable release on an affected Nexus 3000 or Nexus 9000 in standalone NX-OS mode, with NX-API enabled. Cisco says NX-API is disabled by default on these series. |
| NGOAM | CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 | A vulnerable release with NGOAM enabled. CVE-2026-76486 also requires SRv6 or NV Overlay; the NV Overlay case has additional VXLAN EVPN/NVE/VTEP conditions. CVE-2026-76501 requires SRv6. |
| MPLS OAM | CVE-2026-76465 | A vulnerable release with MPLS OAM enabled. Cisco says this feature is disabled by default. Nexus 9000 switches with Silicon One ASICs do not support MPLS OAM and are not affected by this issue. |
For NGOAM, Cisco says Nexus 7000 and Nexus 9000 switches running ACI mode are not affected. Nexus 3000 does not support SRv6, and only a subset of Nexus 9000 supports it. Check each live advisory for the full platform and configuration scope; exclusions for one feature or CVE should not be assumed to apply to every other advisory.
#1 Best Overall
- UNLEASH THE FULL POTENTIAL OF YOUR DATA CENTER WITH UNMATCHED CONNECTIVITY: The Cisco Systems N9K-C93180YC-EX Nexus 9300 switch offers 48 fixed 10/25-Gbps SFP+ ports and 6 fixed 100-Gbps QSFP28 ports, providing you with maximum flexibility and high-bandwidth connectivity to handle even the most demanding applications
- MINIMIZE LATENCY AND MAXIMIZE PERFORMANCE WITH CUT-THROUGH SWITCHING ARCHITECTURE: With a latency of less than 1 microsecond, the N9K-C93180YC-EX switch uses a cut-through switching architecture to provide high-performance computing and big data processing, ensuring smooth and seamless operations.
- TAKE YOUR NETWORK VIRTUALIZATION TO THE NEXT LEVEL WITH VXLAN SUPPORT: The switch's Virtual Extensible LAN (VXLAN) support allows for efficient network virtualization, enabling you to create scalable and highly available networks that are easy to manage and maintain.
- SIMPLIFY YOUR NETWORK AUTOMATION AND MANAGEMENT WITH CISCO APPLICATION CENTRIC INFRASTRUCTURE (ACI): The N9K-C93180YC-EX switch supports Cisco's ACI, a powerful solution for network automation and management that simplifies the deployment and management of virtual and physical networks.
- MAXIMIZE NETWORK AVAILABILITY WITH HOT-SWAPPABLE POWER SUPPLIES AND FANS: The switch is designed for high availability with features such as hot-swappable power supplies and fans, redundant power supplies, and a modular design that allows for easy upgrades and maintenance, ensuring your network stays up and running 24/7.
How to check whether a Nexus switch is exposed
- Identify the platform and operating mode. Record the Nexus model, whether it runs standalone NX-OS or ACI mode, and its exact NX-OS release.
- Check relevant features and dependencies. For NX-API, run
show feature | include nxapi. Cisco’s NGOAM advisory documents CLI checks for NGOAM, NV Overlay, and SRv6. Check for the applicable VXLAN EVPN, NVE, and VTEP configuration when assessing the NV Overlay condition. Review the MPLS OAM advisory and device configuration to determine whether MPLS OAM is enabled. - Check the exact release against Cisco’s Software Checker. Use the specific platform and software information to find whether that combination is affected and which release first fixes it. Cisco updated the NX-API advisory’s fixed-release information on October 8, 2026, so do not rely on a release number copied from another model or software branch. Confirm the live advisory and checker result before scheduling an upgrade.
Being on a vulnerable release alone does not establish exposure when the affected feature or required dependent configuration is absent. Conversely, a feature check alone cannot establish safety: the platform, operating mode, release, and advisory-specific conditions all matter.
What administrators should do
Upgrade to the applicable fixed release
Use the fixed release identified for the exact platform and software branch in Cisco’s Software Checker, then follow the relevant advisory and your normal change process. Cisco says workarounds do not address the underlying vulnerabilities; a fixed software upgrade is the durable remediation.
Consider disabling features that are not needed
If the deployment does not require an affected feature, assess whether disabling it is operationally safe. Cisco says disabling NGOAM removes the attack vector for its three listed vulnerabilities; reports also summarize disabling unneeded NX-API and MPLS OAM as risk reduction. Evaluate dependencies and effects on monitoring or network services with the team responsible for the deployment before changing configuration. Feature disablement is a mitigation, not a substitute for installing fixed software.
Use Live Protect shields only as a bridge
Cisco says Live Protect shields are available as temporary mitigations for the five flaws while software updates are being scheduled. They do not replace upgrading to the applicable fixed release.
Rank #3
- Modular: Yes
- Port/Expansion Slot Details: 48 x 10 Gigabit Ethernet Expansion Slot
- Port/Expansion Slot Details: 6 x 40 Gigabit Ethernet Expansion Slot
- Media Type Supported: Optical Fiber
- Ethernet Technology: 10 Gigabit Ethernet
Has Cisco reported exploitation?
In its NGOAM advisory, Cisco said its Product Security Incident Response Team was not aware of public announcements or malicious use of the vulnerabilities described in that advisory. Cisco also said the issues were found during internal security testing. This is Cisco’s status at the time of that advisory, not a guarantee that exploitation will not emerge later. The sources cited here do not establish a victim count or real-world prevalence figure.
Quick Recap
Rank #4
- Item Package Dimension: 24.0L X 20.0W X 6.0H Inches
- Item Package Weight - 23.2 Pounds
- Item Package Quantity - 1
- Product Type - Electronic Switch
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
