Cisco NX-OS October 2026 security hardening release fixes six vulnerabilities

What happened

Cisco's NX-OS engineering team ran an internal security review and produced a hardening release addressing six vulnerabilities. CVE-2026-76455 is an improper access control issue and CVE-2026-76459 is an out-of-bounds write. Both carry a CVSS 3.1 base score of 9.8 with a network attack vector, low complexity, no privileges and no user interaction, meaning a remote unauthenticated attacker who can reach affected functionality could achieve high confidentiality, integrity and availability impact.

CVE-2026-76453 is improper neutralization and carries CVSS 8.8; it is network-based and requires low privileges. CVE-2026-76456 (improper input validation), CVE-2026-76457 (out-of-bounds read) and CVE-2026-76458 (improper handling of exceptional conditions) each carry CVSS 8.6. Those three are network reachable without credentials but their impact is limited to high availability impact in a changed scope. Cisco's PSIRT says it is not aware of any public announcements or malicious use of these vulnerabilities, and no KEV entries are listed for them.

Who is affected

This affects Cisco's data centre switching and compute management platforms. Affected products include Cisco NX-OS Software releases 8.2(5), 7.3(5)D1(1), 8.4(2), 8.4(3), 9.2(3), 8.2(1), 7.3(1)D1(1) and 9.2(2v); Cisco NX-OS System Software in ACI Mode releases 15.2(1g), 15.2(2e), 15.2(2f), 15.2(2g), 15.2(2h), 15.2(3f), 15.2(3e) and 15.2(3g); and Cisco Unified Computing System (Managed). For most of these CVEs, the affected UCS (Managed) releases are 4.0(1a), 4.1(1d), 4.0(4f), 4.0(4c), 4.0(2b), 4.1(2a), 4.0(4a) and 4.0(4e). For CVE-2026-76456 the affected UCS (Managed) releases are 4.0(1a), 4.1(1a), 4.1(1b), 4.0(4h), 4.1(1c), 4.0(4e), 4.0(4g) and 4.0(2e).

What to do now

1. Confirm whether you run any of the affected NX-OS, ACI mode or UCS (Managed) releases listed above.
2. Consult Cisco's October 2026 NX-OS security hardening advisory for the applicable fixed release for your software train.
3. Apply the hardening release through your normal change process. Cisco states fixes are available, but specific fixed build numbers are not listed in the CVE record; Cisco's advisory is the authoritative source.
4. Because there are no workarounds, restrict network exposure of affected management interfaces until the release is applied.

How to detect it

Cisco's advisory does not provide indicators of compromise. Several of these vulnerabilities are reachable without credentials from the network, so identify internet-facing or untrusted access to affected NX-OS, ACI mode and UCS (Managed) interfaces, and monitor affected devices for unexpected availability issues.

Beyond the patch

This advisory is a useful check on how quickly your team can identify and patch data centre infrastructure, because two of the flaws are reachable without credentials and no workarounds exist. Virtual CISO Services helps find exactly that kind of exposure — network-reachable management interfaces and open ports — before an attacker does. It also illustrates the supply-chain reality: the window between Cisco's hardening release and your maintenance window is the risk that remains. Tracking which vendors' software you run and how quickly fixes land is what Supply Chain Defense & Third-Party Risk covers.