High priorityDisclosed

Advisory · CVE-2026-76453

Cisco NX-OS hardening release fixes injection-class flaws up to CVSS 8.8

Cisco's October 2026 NX-OS hardening release addresses internally found improper-neutralization vulnerabilities grouped under CVE-2026-76453, rated 8.8.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76453
CWE-707
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco's own security check-up found places in its switch software where untrusted input is not cleaned up properly, opening the door to injection attacks. A software update closes them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Internal review

    The Cisco NX-OS engineering team ran a comprehensive internal security review across NX-OS, ACI-mode, and UCS software.

  2. 02CVE grouping

    Improper-neutralization issues are grouped under CVE-2026-76453 (CWE-707 pillar, covering command, OS, and argument injection), with a maximum CVSS of 8.8.

  3. 03Exposure

    The vulnerabilities affect Cisco NX-OS Software, NX-OS System Software in ACI mode, and UCS (Managed) software.

  4. 04Hardened release

    Cisco released hardened software that addresses the vulnerabilities; there are no workarounds.

What happened

On October 7, 2026, Cisco published a security hardening release for Cisco NX-OS Software. The release addresses multiple internally discovered vulnerabilities, grouped by weakness class with one CVE per class. CVE-2026-76453 covers improper-neutralization issues (CWE-707 pillar: command, OS, and argument injection) with a maximum CVSS base score of 8.8, exploitable over the network with low privileges required.

Cisco states the flaws were found during internal testing and are not known to be actively exploited. There are no workarounds. The advisory’s fixed-release guidance covers MDS 9000 (9.4(5a)), Nexus 3000/9000 standalone (10.3(10), 10.4(8), 10.5(6), 10.6(4)), Nexus 7000 (8.4(14)), ACI-mode fabrics (16.0(9h), 16.1(6g), 16.2(3g)), and UCS managed/intersight releases; older trains should migrate to a fixed release.

What to do

  1. Inventory Nexus, MDS, ACI fabric, and UCS infrastructure running affected releases.
  2. Upgrade to the fixed releases listed in the advisory for your platform. There are no workarounds.
  3. Keep switch and fabric management interfaces restricted to trusted networks while upgrades are scheduled.
  4. Verify the running release after upgrading.

Management note

An 8.8 injection class on switching and compute fabric infrastructure is a solid patch-window item. Nothing is known to be exploited, but low-privilege network attackability means exposed management planes should not wait for a convenient quarter.