Dark Web Intelligence on X: "🚨 CISCO PATCHES CVSS 9.8 UNAUTHENTICATED ROOT RCE FLAWS IN NX-OS FOR NEXUS 3000 AND 9000 SWITCHES
Cisco published its October 7, 2026 bundled advisories, including three NX-OS advisories covering five CVSS 9.8 flaws that let a remote, unauthenticated attacker run code as root or crash the switch.
• CVE-2026-76465: MPLS OAM, triggered by a crafted MPLS echo-request (Nexus 3000 / 9000 standalone)
• CVE-2026-76485, CVE-2026-76486, CVE-2026-76501: Generation OAM (NGOAM), crafted packets to an IP interface
• CVE-2026-76471: NX-API, crafted HTTP request (also UCS 6300 Fabric Interconnects, where credentials are needed and Cisco rates it High)
• Impact: arbitrary code with root privileges, or process crashes and device reload (DoS)
• Workarounds: none. Fixed NX-OS software is available; Cisco also released temporary Live Protect shields, and disabling unused MPLS OAM or NGOAM removes the attack vector
• Exposure: MPLS OAM and NX-API are disabled by default; the NGOAM flaws need NGOAM enabled (two also need SRv6 or NV Overlay)
Cisco PSIRT says it is not aware of public announcements or malicious use, and the flaws were found in internal testing. None are in CISA KEV at handoff. Data-center switches are high-value targets, so check whether these features are enabled and patch quickly.
#DDW #DarkWeb #CyberSecurity #Cisco #NXOS #CVE #PatchNow"
🚨 CISCO PATCHES CVSS 9.8 UNAUTHENTICATED ROOT RCE FLAWS IN NX-OS FOR NEXUS 3000 AND 9000 SWITCHES
Cisco published its October 7, 2026 bundled advisories, including three NX-OS advisories covering five CVSS 9.8 flaws that let a remote, unauthenticated attacker run code as root or crash the switch.
• CVE-2026-76465: MPLS OAM, triggered by a crafted MPLS echo-request (Nexus 3000 / 9000 standalone)
• CVE-2026-76485, CVE-2026-76486, CVE-2026-76501: Generation OAM (NGOAM), crafted packets to an IP interface
• CVE-2026-76471: NX-API, crafted HTTP request (also UCS 6300 Fabric Interconnects, where credentials are needed and Cisco rates it High)
• Impact: arbitrary code with root privileges, or process crashes and device reload (DoS)
• Workarounds: none. Fixed NX-OS software is available; Cisco also released temporary Live Protect shields, and disabling unused MPLS OAM or NGOAM removes the attack vector
• Exposure: MPLS OAM and NX-API are disabled by default; the NGOAM flaws need NGOAM enabled (two also need SRv6 or NV Overlay)
Cisco PSIRT says it is not aware of public announcements or malicious use, and the flaws were found in internal testing. None are in CISA KEV at handoff. Data-center switches are high-value targets, so check whether these features are enabled and patch quickly.
🚨 CISCO PATCHES CVSS 9.8 UNAUTHENTICATED ROOT RCE FLAWS IN NX-OS FOR NEXUS 3000 AND 9000 SWITCHES
Cisco published its October 7, 2026 bundled advisories, including three NX-OS advisories covering five CVSS 9.8 flaws that let a remote, unauthenticated attacker run code as root or crash the switch.
• CVE-2026-76465: MPLS OAM, triggered by a crafted MPLS echo-request (Nexus 3000 / 9000 standalone)
• CVE-2026-76485, CVE-2026-76486, CVE-2026-76501: Generation OAM (NGOAM), crafted packets to an IP interface
• CVE-2026-76471: NX-API, crafted HTTP request (also UCS 6300 Fabric Interconnects, where credentials are needed and Cisco rates it High)
• Impact: arbitrary code with root privileges, or process crashes and device reload (DoS)
• Workarounds: none. Fixed NX-OS software is available; Cisco also released temporary Live Protect shields, and disabling unused MPLS OAM or NGOAM removes the attack vector
• Exposure: MPLS OAM and NX-API are disabled by default; the NGOAM flaws need NGOAM enabled (two also need SRv6 or NV Overlay)
Cisco PSIRT says it is not aware of public announcements or malicious use, and the flaws were found in internal testing. None are in CISA KEV at handoff. Data-center switches are high-value targets, so check whether these features are enabled and patch quickly.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
