Cisco NX-OS NX-API Remote Code Execution Vulnerability (CVE-2026-76471)

Cisco NX-OS Software NX-API Remote Code Execution Vulnerability Vulnerability Overview Advisory ID: cisco-se-napi-rce-120hwu2 CVE: 2026-76471 CVSS: 122 First Published: 2026 October 7 16:00 GMT Version: 1.0 Status: Final CVSS Score: Base 9.9 Summary: A vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device with root privileges. The vulnerability is due to insufficient input validation of data sent to NX-API. An attacker can exploit this vulnerability by sending crafted HTTP requests to the NX-API of an affected device. Successful exploitation may allow an attacker to execute arbitrary code with root privileges and may lead to process crashes, resulting in device reloading and DoS conditions. Impact Scope Vulnerable Products: - Nexus 3000 Series Switches (CSCwu46199) - Nexus 9000 Series Switches in standalone NX-OS mode (CSCwu46199) - UCS 6300 Series Fabric Interconnects (CSCwu58579) Products Confirmed Not Vulnerable: - Firepower 1000 Series - Firepower 2100 Series - Firepower 4100 Series - Firepower 9300 Security Appliances - MDS 9000 Series Multilayer Switches - Nexus 7000 Series Switches - Nexus 9000 Series Fabric Switches in ACI mode - Secure Firewall 200 Series - Secure Firewall 1200 Series - Secure Firewall 3100 Series - Secure Firewall 4200 Series - Secure Firewall 6100 Series - UCS 6400 Series Fabric Interconnects - UCS 6500 Series Fabric Interconnects - UCS 6600 Series Fabric Interconnects - UCS X-Series Direct Fabric Interconnect 9108 100G Remediation Workarounds: There are no workarounds to address this vulnerability. Fixed Software: - Cisco NX-OS Software: - Use the Cisco Software Checker tool to determine affected software versions and fixed versions. - Steps: 1. Select the vulnerability advisory to search. 2. Select the appropriate software. 3. Select the appropriate platform. 4. Enter the version number. 5. Click “Check”. - Cisco UCS Software: - UCS 6300 Series Fabric Interconnect: - Cisco UCS Software Release: 4.2 and earlier - First Fixed Release for UCS Manager Managed Mode: Migrate to a fixed release. - First Fixed Release for UCS Intersight Managed Mode: Migrate to a fixed release. - Cisco UCS Software Release: 4.3 - First Fixed Release for UCS Manager Managed Mode: 4.3(6) - First Fixed Release for UCS Intersight Managed Mode: 4.3(6.260049) Proof of Concept No specific POC code or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco NX-OS NX-API Remote Code Execution Vulnerability (CVE-2026-76471)

More from this source