/
← Voltar ao feed
critical

Cisco NX-OS NX-API unauthenticated RCE as root and DoS flaw (CVE-2026-76471) patched, no workarounds

1 fonte(s) · 1 atualização(ões) · publicado 08/10/2026 11:11 · coletado há 4 dias

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed a critical vulnerability, CVE-2026-76471, in the NX-API feature of Cisco NX-OS Software. An unauthenticated, remote attacker could use it to execute arbitrary code with root privileges or to cause a denial of service on an affected device. Cisco rates the Security Impact as Critical. Software updates are available and no workarounds exist. The article does not report exploitation in the wild. The advisory is part of Cisco's October 7, 2026 advance-notification group of security advisories.

Detalhes técnicos

  • The root cause is insufficient input validation of data sent to the NX-API.
  • An attacker exploits it by sending a crafted HTTP request to the NX-API of an affected device.
  • Successful exploitation can yield arbitrary code execution as root. It can also crash processes, which may reload the device and cause a DoS condition.
  • The article does not list affected versions or IOCs.

Remediação

  • Apply the Cisco software updates that fix this vulnerability. Consult the advisory cisco-sa-napi-rce-r2shwu2j for fixed releases.
  • No workarounds exist, so patching is the only mitigation.
  • Cisco also points to its NX-OS Software Security Hardening Release: October 2026 for related fixes.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 08/10/2026 11:11 · coletado 19/10 18:01 primeiro registro só resumo do feed

    Cisco NX-OS NX-API unauthenticated RCE as root and DoS flaw (CVE-2026-76471) patched, no workarounds

    ler a análise desta fonte

    Cisco disclosed a critical vulnerability, CVE-2026-76471, in the NX-API feature of Cisco NX-OS Software. An unauthenticated, remote attacker could use it to execute arbitrary code with root privileges or to cause a denial of service on an affected device. Cisco rates the Security Impact as Critical. Software updates are available and no workarounds exist. The article does not report exploitation in the wild. The advisory is part of Cisco's October 7, 2026 advance-notification group of security advisories.

    Technical Details

    • The root cause is insufficient input validation of data sent to the NX-API.
    • An attacker exploits it by sending a crafted HTTP request to the NX-API of an affected device.
    • Successful exploitation can yield arbitrary code execution as root. It can also crash processes, which may reload the device and cause a DoS condition.
    • The article does not list affected versions or IOCs.

    Remediation

    • Apply the Cisco software updates that fix this vulnerability. Consult the advisory cisco-sa-napi-rce-r2shwu2j for fixed releases.
    • No workarounds exist, so patching is the only mitigation.
    • Cisco also points to its NX-OS Software Security Hardening Release: October 2026 for related fixes.