Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Cisco Releases NX-OS Software Security Hardening Guidance

The critical advisory addresses multiple vulnerability classes affecting Cisco NX-OS software deployments

Threat ID:
CC-4864
Threat Severity:
Medium
Published:
9 October 2026 11:11 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The critical advisory addresses multiple vulnerability classes affecting Cisco NX-OS software deployments

Threat details

Introduction

Cisco has published a security hardening advisory for Cisco NX-OS Software following a comprehensive internal security review. The update addresses multiple vulnerability classes including improper neutralization, improper access control, improper input validation, out-of-bounds read, improper handling of exceptional conditions, out-of-bounds write, and heap-based buffer overflow vulnerabilities.

To streamline disclosure, Cisco grouped vulnerabilities according to their underlying Common Weakness Enumeration (CWE) category and assigned a single CVE identifier to each group. Several of the vulnerability classes have high severity ratings, with the two most severe vulnerabilities carrying a CVSS score of 9.8.

Vulnerability Details

  • CVE-2026-76453 - 'Improper neutralization' vulnerability - CVSSv3.1 score of 8.8
  • CVE-2026-76455 - 'Improper access control' vulnerability - CVSSv3.1 score of 9.8
  • CVE-2026-76456 - 'Improper input validation' vulnerability - CVSSv3.1 score of 8.6
  • CVE-2026-76457 - 'Out-of-bounds read' vulnerability - CVSSv3.1 score of 8.6
  • CVE-2026-76458 - 'Improper handling of exceptional conditions' vulnerability - CVSSv3.1 score of 8.6
  • CVE-2026-76459 - 'Out-of-bounds write' vulnerability - CVSSv3.1 score of 9.8
  • CVE-2026-76471 - 'Heap-based buffer overflow' vulnerability - CVSSv3.1 score of 9.8

Remediation advice

Affected organisations are encouraged to review the Cisco advisory Cisco NX-OS Software Security Hardening Release: October 2026 (cisco-sa-hardening-nxosw1-cWzSbtR), assess exposure, and prioritise applying relevant updates.

CVE Vulnerabilities

Status Published

CVE-2026-76453

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76453 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) CWE-707.
Status Published

CVE-2026-76455

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76455 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Status Published

CVE-2026-76456

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used in a command issue that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
Status Published

CVE-2026-76457

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under the Common Weakness Enumeration (CWE) CWE-125.
Status Published

CVE-2026-76458

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76458 are related to improper handling of exceptional conditions issues that are grouped under the Common Weakness Enumeration (CWE) CWE-703.
Status Published

CVE-2026-76459

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under the Common Weakness Enumeration (CWE) CWE-787.
Status Published

CVE-2026-76471

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.

Last edited: 9 October 2026 11:11 am