Cisco Releases Hardening Fix for Critical NX-OS Vulnerability

Cisco has released NX-OS software hardening updates that address CVE-2026-76455, a critical improper access control entry scored 9.8 under CVSS 3.1.

Cisco conducted an internal security review. The Cisco NX-OS engineering team performed a comprehensive internal security review as part of its ongoing commitment to proactive security and product quality. The review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

One CVE ID covers each weakness class. Cisco grouped the issues by Common Weakness Enumeration class and assigned a single CVE to each. CVE-2026-76455 covers the improper access control class, CWE-284, which spans authorization, authentication, privilege, and bypass issues. Its 9.8 score reflects the most severe issue in that group.

The worst case is remote and unauthenticated. The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes a network attack with low complexity that needs no privileges or user interaction, with high impact on confidentiality, integrity, and availability.

No exploitation is known. Cisco says the issues were found during internal testing, and its PSIRT is not aware of public announcements or malicious use. There are no workarounds.

Switches and fabric interconnects are affected. Cisco's advisory, cisco-sa-hardening-nxosw1-cWzSbtR, lists MDS 9000 Series switches, Nexus 3000, 7000, and 9000 Series switches, and UCS 6300, 6400, 6500, and 6600 Series and X-Series Direct 9108 100G fabric interconnects. First fixed releases include NX-OS 10.3(10), 10.4(8), 10.5(6), and 10.6(4) for Nexus 3000 and standalone Nexus 9000, 8.4(14) for Nexus 7000, and 9.4(5a) for MDS 9000.

This is separate from the Nexus MPLS OAM flaw. The hardening advisory is distinct from CVE-2026-76465, the MPLS OAM root code execution flaw Cisco disclosed for Nexus 3000 and 9000 switches the same day.