Cisco Warns of Five Critical NX-OS Flaws Affecting Nexus Switches

Cisco has issued advisories for five critical vulnerabilities in NX-OS, its data center network operating system. The flaws could let attackers run arbitrary code with root privileges on affected Nexus switches. If remote code execution is not possible, exploitation could crash processes and force a device to reload, causing a denial-of-service condition.

The vulnerabilities affect Nexus 3000 and Nexus 9000 Series switches running standalone NX-OS. Exploitation requires at least one of three features to be active: NX-API, Next Generation OAM (NGOAM), or MPLS OAM. Some flaws have additional requirements. For CVE-2026-76486, Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay must also be enabled. CVE-2026-76501 requires SRv6, which is supported on some Nexus 9000 models. CVE-2026-76465 requires MPLS OAM, which is disabled by default.

Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected. Nexus 9000 switches with Silicon One ASICs are also unaffected by CVE-2026-76465.

Cisco recommends upgrading to a fixed NX-OS release identified through its Software Checker tool. It also recommends disabling the affected features if they are not needed. Temporary Live Protect shields are available for switches that cannot yet be upgraded and rebooted. Cisco said the flaws were found during internal testing and that it was unaware of public disclosure or malicious exploitation when it issued the advisories.