Major Cisco Security Update Released
Cisco recently disclosed 35 CVE identifiers. Subsequently, the company released a substantial suite of security updates. Specifically, five vulnerabilities affect Nexus 3000 and 9000 switches. Under particular configurations, these flaws permit unauthenticated remote attackers to obtain root privileges. Furthermore, researchers discovered maximum-severity flaws across several other product lines.
Critical Cisco NX-OS Vulnerabilities
The NX-OS network operating system harbors severe complications. Notably, the CVE-2026-76471 vulnerability directly compromises the NX-API management interface. An adversary merely needs to dispatch a specially crafted HTTP request. This action allows them to attempt arbitrary code execution with root privileges. Additionally, this critical flaw allows attackers to trigger process crashes. It can also force device reboots and significantly disrupt network operations. Consequently, it carries a formidable CVSS score of 9.8.
Three additional vulnerabilities pertain to NGOAM network diagnostics. These include CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. Meanwhile, a distinct flaw resides within the MPLS OAM mechanism. We identify this flaw as CVE-2026-76465. By leveraging manipulated IP packets, an attacker could achieve code execution with maximum privileges. Alternatively, they could instigate a severe denial-of-service condition. Ultimately, all four issues earned a CVSS rating of 9.8.
Configuration Requirements for Exploitation
Fortunately, not every Nexus device remains acutely vulnerable. For attacks exploiting the NX-API and MPLS OAM, administrators must actively enable the corresponding features. By default, they remain deactivated on Nexus 3000 and 9000 switches. The NGOAM vulnerabilities similarly depend on specific configurations. They require SRv6 or VXLAN implementations in certain instances. The NX-API flaw also affects the UCS 6300 platform. However, exploiting it requires the malicious actor to possess valid user credentials.
In parallel, Cisco rectified numerous NX-OS errors. The team consolidated them into six distinct CWE categories. These encompass inadequate access controls and out-of-bounds memory writing. Experts also rated these at an alarming 9.8 on the CVSS scale. These crucial updates span beyond the Nexus 3000 and 9000 series. They explicitly encompass the Nexus 7000, MDS 9000, and various UCS Fabric Interconnect modules. Unlike the diagnostic function defects, this group of vulnerabilities operates independently of specific user configurations.
License On-Prem and Additional Platforms
Investigators exposed eight distinct CVEs within the Cisco License On-Prem platform. The most perilous issue, designated CVE-2026-76482, commanded a maximum 10-point severity score. This resulted from improper cryptographic signature validation. Another profound error empowers unauthenticated entities to indiscriminately reset passwords. They can compromise arbitrary accounts, including those holding administrative privileges. Furthermore, a separate Meraki update package addresses seven vulnerability categories. These impact their gateways, switches, access points, and surveillance cameras.
Mitigation efforts also extended to APIC controllers. These components govern data center networks. Three specific vulnerability clusters within this domain garnered CVSS scores of 9.8. An isolated API defect permits any user holding an administrative account to execute arbitrary commands. They can do this with unrestricted root permissions. Meanwhile, researchers identified an opportunity to forge server-side requests within Cisco Finesse. An official remediation remains under active development. Cisco formally published all related security bulletins on October 7. They aggregated them within a comprehensive summary advisory.
Currently, Cisco has not reported any active exploitation of these newly disclosed vulnerabilities. The corporation strongly advises administrators to diligently verify their software versions. They must promptly deploy the provided patches. However, clients should note a specific delay. Certain Meraki firmware updates will only become available in late October or mid-November.
