Cisco warns of critical flaws allowing Nexus switch takeover

Cisco has published fixes for five critical vulnerabilities in NX-OS, the operating system running its Nexus data center switches, which could let an attacker execute code with root privileges or at least crash the device and trigger a reload. The bugs affect Nexus 3000 and 9000 Series switches running in standalone NX-OS mode, and only trigger when the NX-API, Next Generation OAM (NGOAM), or MPLS OAM features are enabled on the device. CVE-2026-76471 stems from weak input validation in NX-API and is reachable via a crafted HTTP request, while CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501 involve flawed IP traffic checks tied to NGOAM (with CVE-2026-76486 additionally requiring SRv6 or NV Overlay, and CVE-2026-76501 requiring SRv6). CVE-2026-76465 concerns improper handling of MPLS echo-request packets when MPLS OAM is turned on, though switches with Silicon One ASICs are immune. Nexus 7000 devices and Nexus 9000 units in ACI mode are not impacted. Cisco says the flaws were found internally, with no evidence of public disclosure or active exploitation, and urges customers to update to a fixed NX-OS build, disable the unused features, or apply the temporary Live Protect shield while patching is scheduled.