CVE-2026-76459 – Cisco NX-OS Software
“When one crafted packet can hand an attacker root on your core switch, the network itself becomes the breach.”
Cisco has released a security update for Cisco NX-OS Software that fixes eight vulnerabilities. Seven are Critical and one is High. Five of them let an unauthenticated, remote attacker run arbitrary code with root privileges or cause a denial of service (DoS). An attacker only needs to send crafted traffic to an affected device. Affected features include NX-API, MPLS OAM on Cisco Nexus 3000 and 9000 Series Switches, VXLAN OAM (NGOAM), and SRv6 OAM. CVE-2026-76471 (NX-API) has a CVSS score of 9.8, Critical severity. CVE-2026-76465 (MPLS OAM) has a CVSS score of 9.8, Critical severity. CVE-2026-76485 and CVE-2026-76486 (VXLAN NGOAM) each have a CVSS score of 9.8, Critical severity. CVE-2026-76501 (SRv6 NGOAM) has a CVSS score of 9.8, Critical severity.
The same update includes a software hardening release that fixes flaws found in Cisco's internal security review. CVE-2026-76455 is an improper access control flaw with a CVSS score of 9.8, Critical severity. CVE-2026-76459 is an out-of-bounds write flaw with a CVSS score of 9.8, Critical severity. CVE-2026-76457 is an out-of-bounds read flaw with a CVSS score of 8.6, High severity. A successful attack can crash processes, reload switches, and take down core data center traffic.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-787