Cisco NX-OS NX-API remote code execution lets unauthenticated attackers execute code as root (CVE-2026-76471)

What happened

Cisco NX-OS Software has a critical vulnerability in its NX-API feature. Insufficient input validation means an unauthenticated, remote attacker can send a crafted HTTP request to the NX-API and execute arbitrary code with root privileges on the affected device. A successful exploit can also crash processes and force a reload, causing a denial of service. Cisco rates this 9.8 Critical (CVSS 3.1), with network attack vector, low complexity, no privileges and no user interaction.

Cisco's Product Security Incident Response Team states it is not aware of any public announcements or malicious use of the vulnerability. The flaw is tracked as CVE-2026-76471.

Who is affected

Cisco lists the affected software as Cisco NX-OS Software releases 9.2(3), 9.2(2v), 9.2(1), 9.2(2t), 9.2(3y), 9.3(2), 9.2(4) and 9.3(1), and Cisco Unified Computing System (Managed) releases 4.0(1a), 4.1(1d), 4.0(4f), 4.0(4a), 4.0(4e), 4.0(4c), 4.0(4h) and 4.1(1c). The deciding factor for exposure is whether the NX-API feature is enabled and reachable on those releases.

What to do now

1. Cisco has released fixed software. Apply the release for your platform; the fixed release numbers are not shown here, so consult the Fixed Software section of Cisco's advisory.
2. Until you can upgrade, apply Cisco's Live Protect shield for CVE-2026-76471 on Cisco NX-OS Software. Cisco describes this as a temporary mitigation, not a substitute for a fixed release.
3. Cisco states there are no workarounds that address the vulnerability itself. If neither upgrade nor the shield is immediately possible, restrict network access to NX-API so it is not reachable from untrusted networks.

How to detect it

Unexpected process crashes or reloads on devices with NX-API enabled may indicate attempted exploitation, because a successful exploit can force a reload. Cisco has not published specific indicators of compromise, and PSIRT is not aware of malicious use.

Beyond the patch

This is a pre-authentication, network-reachable code execution flaw, so the priority after patching is to find and reduce exposed NX-API interfaces. Virtual CISO Services can help you inventory and close exposed management services, and Managed Detection & Response can watch for the post-exploitation activity that follows root-level code execution. Apply the fix first, then close the exposure so the next NX-OS advisory matters less.