Vulnerabilities · Networking
Cisco warns of critical flaws in Nexus switches: attackers could take control
Cisco has disclosed five critical vulnerabilities in its Nexus switches that could let attackers run code or disrupt networks. The flaws affect certain features and require urgent patching.
Ross GrantUpdated 3 min read
The short version
Cisco has found serious security flaws in some of its Nexus switches. If certain features are turned on, attackers could take control of the switch or make it crash. Cisco recommends updating the software and turning off unused features to stay safe.
What happened?
Cisco has disclosed five critical vulnerabilities in its NX-OS software for Nexus 3000 and 9000 Series switches. The flaws could let attackers run code with root privileges or crash the device. Cisco found the issues during internal testing and says there is no evidence of attacks so far.
What Cisco has revealed
Cisco has released security advisories for five critical vulnerabilities in its NX-OS operating system, which runs on Nexus 3000 and 9000 Series switches. According to BleepingComputer (opens in a new tab), these flaws could let an attacker run code with the highest system privileges (root) or crash the device, causing a denial-of-service. Cisco found the issues during internal security testing and says it is not aware of any attacks using these flaws so far.
Which switches and features are affected
The vulnerabilities affect Nexus 3000 and 9000 Series switches running in standalone NX-OS mode. They only pose a risk if certain features are enabled:
- NX-API (disabled by default)
- Next Generation OAM (NGOAM)
- MPLS OAM
Some flaws also require advanced features like Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay to be active. For example, one vulnerability (CVE-2026-76486) needs either SRv6 or NV Overlay, and another (CVE-2026-76501) only affects devices with SRv6 enabled. MPLS OAM is off by default and only affects certain models. Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected.
How attackers could exploit the flaws
The root cause is insufficient input validation in the affected features. Attackers could send specially crafted network requests or packets to the switch. Depending on the flaw, this could allow them to:
- Run arbitrary code as root (full control of the device)
- Crash key processes, forcing the switch to reload (denial-of-service)
For example, CVE-2026-76471 can be exploited through a crafted HTTP request to the NX-API. Others involve sending crafted packets to interfaces with NGOAM or MPLS OAM enabled. Some require complex configurations, such as VXLAN overlays with specific peerings.
What Cisco recommends
Cisco urges customers to upgrade to fixed NX-OS versions, which can be checked using Cisco's Software Checker tool. If upgrading is not possible right away, Cisco suggests disabling the affected features (NX-API, NGOAM, MPLS OAM) if they are not needed. The company also provides temporary "Live Protect" shields for all five flaws, which help protect switches that cannot yet be patched and rebooted.
In addition, Cisco released security updates for its License (formerly Smart Software Manager) product, addressing separate critical flaws. Some of these issues affect all configurations, and older, unsupported versions will not be patched. Cisco recommends migrating to supported releases.
What happens next
As of now, there are no reports of these vulnerabilities being exploited in the wild. However, network teams running affected Nexus switches should act quickly to patch or mitigate the flaws. Keeping network infrastructure up to date is essential to prevent attackers from gaining control or causing outages. If you manage Cisco Nexus switches, review your configurations and apply the recommended updates or mitigations as soon as possible.
What you should do
- Check if your switches run NX-OS and have the affected features enabled.
- Use Cisco's Software Checker to find the right fixed version.
- Upgrade to the patched release if possible.
- Disable NX-API, NGOAM, or MPLS OAM if not required.
- Apply Live Protect shields if you cannot upgrade immediately.
- Review Cisco's full advisories for detailed guidance.
Claimed vs confirmed
- Confirmed
Cisco has released advisories for five critical flaws in Nexus switches.
Reported by BleepingComputer, citing Cisco advisories.
- Confirmed
Attackers can take over affected switches if certain features are enabled.
BleepingComputer reports that remote code execution is possible if NX-API, NGOAM, or MPLS OAM are enabled.
- Confirmed
No exploitation in the wild has been observed.
Cisco says it is not aware of public exploitation at the time of the advisory.
The impact
- Money
- If exploited, these flaws could disrupt business operations and lead to regulatory scrutiny. Under UK GDPR, fines can reach £17.5m or 4% of global annual turnover for serious breaches.
- Reputation
- A successful attack on data centre switches could damage trust in Cisco and affected organisations, especially if it leads to outages or data loss.
- Customers
- Organisations using affected Nexus switches risk network disruption or compromise. Customers should patch and review configurations as soon as possible.
Why it matters
These switches are used in many data centres and large networks. If attackers gain control, they could disrupt business operations or access sensitive data. Patching is urgent for organisations using affected models.
How does it work?
The vulnerabilities stem from insufficient input validation in features like NX-API, NGOAM, and MPLS OAM. Attackers could send crafted requests or packets to exploit these flaws, potentially running code as root or crashing the switch. Some require advanced features to be enabled.
Key points
- Five critical flaws affect Cisco Nexus 3000 and 9000 switches running NX-OS.
- Attackers could take full control or cause denial-of-service if certain features are enabled.
- Cisco recommends urgent patching and disabling unused features.
- No evidence of exploitation has been reported so far.
- Temporary protections are available for switches that cannot be updated immediately.
Sources
BleepingComputer
Reference
