Act nowDisclosed

Advisory · CVE-2026-76459

Cisco NX-OS hardening release fixes out-of-bounds write flaws up to CVSS 9.8

Cisco's October 2026 NX-OS hardening release addresses internally found out-of-bounds write issues grouped under CVE-2026-76459, with Cisco assigning a maximum CVSS of 9.8.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76459
CWE-787
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco's switch software could be tricked into writing data past the end of its reserved space, which is a classic way to hijack a device. The update fixes the boundaries.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Internal review

    The Cisco NX-OS engineering team ran a comprehensive internal security review across NX-OS, ACI-mode, and UCS software.

  2. 02CVE grouping

    Out-of-bounds write issues (CWE-787 pillar: stack and heap buffer overflows, incorrect buffer size calculation) are grouped under CVE-2026-76459; Cisco assigns a maximum CVSS of 9.8 to the grouping.

  3. 03Exposure

    The vulnerabilities affect Cisco NX-OS Software, NX-OS System Software in ACI mode, and UCS (Managed) software.

  4. 04Hardened release

    Cisco released hardened software that addresses the vulnerabilities; there are no workarounds.

What happened

On October 7, 2026, Cisco published a security hardening release for Cisco NX-OS Software. CVE-2026-76459 groups out-of-bounds write issues (CWE-787 pillar: stack-based and heap-based buffer overflows, classic buffer overflows, and incorrect buffer size calculation). Cisco assigns a maximum CVSS base score of 9.8 to this grouping. The vulnerabilities affect Cisco NX-OS Software, NX-OS System Software in ACI mode, and UCS (Managed) software.

Cisco states the flaws were found during internal testing and are not known to be actively exploited. There are no workarounds. The advisory’s fixed-release guidance covers MDS 9000 (9.4(5a)), Nexus 3000/9000 standalone (10.3(10), 10.4(8), 10.5(6), 10.6(4)), Nexus 7000 (8.4(14)), ACI-mode fabrics (16.0(9h), 16.1(6g), 16.2(3g)), and UCS managed/intersight releases; older trains should migrate to a fixed release.

What to do

  1. Inventory Nexus, MDS, ACI fabric, and UCS infrastructure running affected releases.
  2. Upgrade to the fixed releases listed in the advisory for your platform. There are no workarounds.
  3. Keep fabric and switch management planes restricted to trusted networks while upgrades are scheduled.
  4. Verify the running release after upgrading.

Management note

Buffer overflows on the network fabric are the class of bug that turns into remote code execution. Cisco’s own maximum for this grouping is 9.8, so treat the upgrade as urgent even though nothing is known to be exploited yet.