Cisco has revealed 35 CVE IDs and released a large update package. Five vulnerabilities in Nexus 3000 and 9000 switches at certain settings allow you to remotely get root rights without a password. In other products there were errors with maximum risk assessment.
Serious problems were found in the network operating system NX-OS. The vulnerability of CVE-2026-76471 affects the NX-API control interface. It is enough to send a specially prepared HTTP request to try to execute arbitrary code with root rights. The error also allows you to cause a failure of the process, restart the device and disrupt the network. The CVSS score is 9.8 points.
Three more vulnerabilities, CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501, are related to NGOAM network diagnostics. A separate error of CVE-2026-76465 is found in the MPLS OAM mechanism. Through specially formed IP packets or diagnostic requests, the attacker can achieve code execution with maximum privileges or cause denial of service. All four problems received 9.8 CVSS points.
However, not every Nexus is at risk. For attacks through NX-API and MPLS OAM, the corresponding functions must be enabled, and by default on Nexus 3000 and 9000 switches, they are disabled. NGOAM vulnerabilities also depend on settings: in some cases, SRv6 or VXLAN are needed. NX-API also affects UCS 6300, but there the attacker needs a valid account with limited rights.
In parallel, Cisco fixed NX-OS errors, combining them into six CWE categories. Among them are insufficient access control and memory recording, estimated at 9.8 CVSS. The updates affect not only the Nexus 3000 and 9000, but also the Nexus 7000, MDS 9000 and the UCS Fabric Interconnect series. Unlike errors in diagnostic functions, vulnerabilities of this group are independent of settings.
The Cisco License On-Prem platform identified eight CVEs. The most dangerous, CVE-2026-76482, received 10 points for incorrect verification of cryptographic signature. Another error allows you to reset passwords of other people's accounts, including administrative ones, without authorization. A separate Meraki package covers seven categories of vulnerabilities in gateways, switches, access points and cameras.
The corrections affected the APIC controllers for data center networks. Three groups of vulnerabilities received 9.8 CVSS points. A separate defect in the API allows the owner of the administrative account to execute commands with root rights. Cisco Finesse has discovered the ability to fake server requests, the correction is still being prepared. All Cisco bulletins were released on October 7, collecting them in a general summary.
Cisco has not yet reported on the use of new vulnerabilities in attacks. The company recommends checking the software versions and installing corrections. Some Meraki firmware will only appear in late October or mid-November.
Serious problems were found in the network operating system NX-OS. The vulnerability of CVE-2026-76471 affects the NX-API control interface. It is enough to send a specially prepared HTTP request to try to execute arbitrary code with root rights. The error also allows you to cause a failure of the process, restart the device and disrupt the network. The CVSS score is 9.8 points.
Three more vulnerabilities, CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501, are related to NGOAM network diagnostics. A separate error of CVE-2026-76465 is found in the MPLS OAM mechanism. Through specially formed IP packets or diagnostic requests, the attacker can achieve code execution with maximum privileges or cause denial of service. All four problems received 9.8 CVSS points.
However, not every Nexus is at risk. For attacks through NX-API and MPLS OAM, the corresponding functions must be enabled, and by default on Nexus 3000 and 9000 switches, they are disabled. NGOAM vulnerabilities also depend on settings: in some cases, SRv6 or VXLAN are needed. NX-API also affects UCS 6300, but there the attacker needs a valid account with limited rights.
In parallel, Cisco fixed NX-OS errors, combining them into six CWE categories. Among them are insufficient access control and memory recording, estimated at 9.8 CVSS. The updates affect not only the Nexus 3000 and 9000, but also the Nexus 7000, MDS 9000 and the UCS Fabric Interconnect series. Unlike errors in diagnostic functions, vulnerabilities of this group are independent of settings.
The Cisco License On-Prem platform identified eight CVEs. The most dangerous, CVE-2026-76482, received 10 points for incorrect verification of cryptographic signature. Another error allows you to reset passwords of other people's accounts, including administrative ones, without authorization. A separate Meraki package covers seven categories of vulnerabilities in gateways, switches, access points and cameras.
The corrections affected the APIC controllers for data center networks. Three groups of vulnerabilities received 9.8 CVSS points. A separate defect in the API allows the owner of the administrative account to execute commands with root rights. Cisco Finesse has discovered the ability to fake server requests, the correction is still being prepared. All Cisco bulletins were released on October 7, collecting them in a general summary.
Cisco has not yet reported on the use of new vulnerabilities in attacks. The company recommends checking the software versions and installing corrections. Some Meraki firmware will only appear in late October or mid-November.
