Affected Systems

Cisco Nexus 3000 and 9000 Series switches running NX-OS in standalone mode. Exploitation requires NX-API, Next Generation OAM (NGOAM), or MPLS OAM features to be enabled. Nexus 7000 and Nexus 9000 in ACI mode are not affected. CVEs: CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76465.

Exploitation Status

No active exploitation or public PoCs reported. All five vulnerabilities discovered during Cisco internal security testing. Cisco unaware of public announcements or malicious use at advisory publication.

Business Impact

Successful exploitation grants arbitrary code execution with root privileges on affected Nexus switches, enabling full device compromise. Alternatively, attackers can trigger denial-of-service by crashing processes and forcing device reload. Impact limited to environments where NX-API, NGOAM, or MPLS OAM are actively configured. Data center network infrastructure at risk if vulnerable features are enabled.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Identify all Nexus 3000 and 9000 switches running standalone NX-OS using asset inventory and verify which have NX-API, NGOAM, or MPLS OAM enabled
  • Use Cisco Software Checker tool to determine fixed NX-OS versions for affected devices and schedule upgrades immediately
  • Disable NX-API, NGOAM, and MPLS OAM features on devices where they are not operationally required to eliminate attack vectors
  • Deploy Cisco Live Protect shields as temporary mitigation for switches that cannot be immediately upgraded or rebooted
  • Monitor switch logs and NX-API access logs for unexpected HTTP requests or malformed MPLS/NGOAM packets targeting management interfaces