/
← Voltar ao feed
high

Cisco releases NX-OS hardening updates for six internally found flaws rated Critical; no workarounds, no known exploitation

1 fonte(s) · 2 atualização(ões) · publicado 07/10/2026 13:00 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco published the NX-OS Software Security Hardening Release: October 2026 advisory (cisco-sa-hardening-nxosw1-cWzSbtR) on 7 October 2026. It covers multiple vulnerabilities found by the Cisco NX-OS engineering team during an internal security review. Cisco rates the security impact as Critical and says the flaws are not known to be actively exploited. To simplify disclosure, Cisco grouped the issues by Common Weakness Enumeration (CWE) class and assigned one CVE ID per class, giving six CVEs. Software updates are available, and there are no workarounds.

Technical Details

  • CVEs: CVE-2026-76453, CVE-2026-76455, CVE-2026-76456, CVE-2026-76457, CVE-2026-76458, CVE-2026-76459.
  • The advisory excerpt does not state the specific weakness classes, the affected NX-OS versions, or whether authentication is required.
  • No exploitation in the wild is reported.

Remediation

  • Upgrade Cisco NX-OS Software to the fixed releases listed in the Cisco advisory.
  • No workarounds exist, so patching is the only mitigation.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 07/10/2026 13:00 · coletado 19/10 18:01 só resumo do feed

    Cisco releases NX-OS hardening updates for six internally found flaws rated Critical; no workarounds, no known exploitation

    The pre-announcement listed these six CVEs only by identifier and severity. The full advisory adds that they were found during internal Cisco testing and are not known to be exploited. It also confirms that fixed software is released, that there are no workarounds, and that the CVEs are grouped by CWE class, one CVE per class.

    ler a análise desta fonte

    The pre-announcement listed these six CVEs only by identifier and severity. The full advisory adds that they were found during internal Cisco testing and are not known to be exploited. It also confirms that fixed software is released, that there are no workarounds, and that the CVEs are grouped by CWE class, one CVE per class.

    Cisco published the NX-OS Software Security Hardening Release: October 2026 advisory (cisco-sa-hardening-nxosw1-cWzSbtR) on 7 October 2026. It covers multiple vulnerabilities found by the Cisco NX-OS engineering team during an internal security review. Cisco rates the security impact as Critical and says the flaws are not known to be actively exploited. To simplify disclosure, Cisco grouped the issues by Common Weakness Enumeration (CWE) class and assigned one CVE ID per class, giving six CVEs. Software updates are available, and there are no workarounds.

    Technical Details

    • CVEs: CVE-2026-76453, CVE-2026-76455, CVE-2026-76456, CVE-2026-76457, CVE-2026-76458, CVE-2026-76459.
    • The advisory excerpt does not state the specific weakness classes, the affected NX-OS versions, or whether authentication is required.
    • No exploitation in the wild is reported.

    Remediation

    • Upgrade Cisco NX-OS Software to the fixed releases listed in the Cisco advisory.
    • No workarounds exist, so patching is the only mitigation.
  2. sec.cloudapps.cisco.com ↗ · pub. 07/10/2026 13:00 · coletado 19/10 18:01 primeiro registro só resumo do feed

    Cisco pre-announces October 7, 2026 advisories: critical NX-OS and Nexus RCE flaws (CVSS 9.8)

    ler a análise desta fonte

    Cisco PSIRT published its advance notification for security advisories released on October 7, 2026, led by several Critical (CVSS 9.8) remote code execution vulnerabilities in Cisco NX-OS Software and Cisco Nexus 3000 and 9000 Series Switches. Medium-severity flaws were also listed: a contract bypass in ACI mode, a control plane denial of service and a Python sandbox escape. The notice also lists a Cisco Application Policy Infrastructure Controller section, but the article text is truncated before any of its details. The article does not mention exploitation in the wild. Cisco strongly recommends upgrading to the fixed software indicated in each advisory.

    Technical Details

    • NX-OS Software Security Hardening Release: October 2026: CVE-2026-76455, CVE-2026-76456, CVE-2026-76457, CVE-2026-76459, CVE-2026-76458, CVE-2026-76453 (Critical, 9.8).
    • Nexus 3000/9000 MPLS OAM Remote Code Execution: CVE-2026-76465 (Critical, 9.8).
    • Nexus 3000/9000 NGOAM Remote Code Execution: CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 (Critical, 9.8).
    • NX-OS NX-API Remote Code Execution: CVE-2026-76471 (Critical, 9.8).
    • Nexus 9000 Fabric Switches in ACI Mode Endpoint Group Contract Bypass: CVE-2026-20038 (Medium, 5.8).
    • NX-OS Control Plane Denial of Service: CVE-2026-20173 (Medium, 5.8).
    • NX-OS Python Sandbox Escape: CVE-2026-20032 (Medium, 4.4).
    • The notice does not state whether authentication is required or whether any flaw is exploited.

    Remediation

    • Upgrade affected NX-OS and Nexus devices to the fixed software releases listed in the individual Cisco advisories.
    • Prioritize the CVSS 9.8 RCE issues (MPLS OAM, NGOAM, NX-API) on Nexus 3000 and 9000 switches.
    • Review the APIC advisories, which are not detailed in the available text.