High priorityDisclosed

Advisory · CVE-2026-76458

Cisco NX-OS hardening release fixes exceptional-condition flaws up to CVSS 8.6

Cisco's October 2026 NX-OS hardening release addresses internally found improper-handling-of-exceptional-conditions issues grouped under CVE-2026-76458, rated 8.6.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76458
CWE-703
Action timing
Immediate
ELI5

Explain it like I’m five

Parts of Cisco's switch software did not handle surprise situations gracefully, and a remote nudge could crash them. The update teaches the software to handle surprises.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Internal review

    The Cisco NX-OS engineering team ran a comprehensive internal security review across NX-OS, ACI-mode, and UCS software.

  2. 02CVE grouping

    Improper-handling-of-exceptional-conditions issues (CWE-703 pillar: uncaught exceptions, reachable assertions) are grouped under CVE-2026-76458, with a maximum CVSS of 8.6.

  3. 03Remote trigger

    The issues are remotely triggerable with no privileges and no user interaction, and can crash processes into a denial of service.

  4. 04Hardened release

    Cisco released hardened software that addresses the vulnerabilities; there are no workarounds.

What happened

On October 7, 2026, Cisco published a security hardening release for Cisco NX-OS Software. CVE-2026-76458 groups improper-handling-of-exceptional-conditions issues (CWE-703 pillar: uncaught exceptions and reachable assertions) with a maximum CVSS base score of 8.6, remotely triggerable with no privileges and no user interaction, impacting availability. The vulnerabilities affect Cisco NX-OS Software, NX-OS System Software in ACI mode, and UCS (Managed) software.

Cisco states the flaws were found during internal testing and are not known to be actively exploited. There are no workarounds. The advisory’s fixed-release guidance covers MDS 9000 (9.4(5a)), Nexus 3000/9000 standalone (10.3(10), 10.4(8), 10.5(6), 10.6(4)), Nexus 7000 (8.4(14)), ACI-mode fabrics (16.0(9h), 16.1(6g), 16.2(3g)), and UCS managed/intersight releases; older trains should migrate to a fixed release.

What to do

  1. Inventory Nexus, MDS, ACI fabric, and UCS infrastructure running affected releases.
  2. Upgrade to the fixed releases listed in the advisory for your platform. There are no workarounds.
  3. Monitor for unexpected reloads or process crashes, which can signal both the flaw and probing.
  4. Verify the running release after upgrading.

Management note

Availability-only flaws on network fabric rarely make headlines, but a remotely triggerable crash with no credentials needed is a cheap way to cause an outage. Fold this into the same maintenance window as the other October NX-OS hardening fixes.