Cisco has released fixes for 35 vulnerabilities across its product line, more than a dozen of them rated critical, including five flaws in the NX-OS software that runs its Nexus data center switches, BleepingComputer and SecurityWeek reported Thursday. The Nexus bugs can let an attacker execute code with root privileges or knock a switch offline.

What Happened

The five critical NX-OS flaws affect Nexus 3000 and Nexus 9000 Series switches running in standalone NX-OS mode, according to BleepingComputer. Each depends on a feature that must be turned on for the device to be exposed.

CVE-2026-76471 stems from insufficient input validation in NX-API, the switch's programmable interface, and can be triggered with crafted HTTP requests. NX-API is disabled by default.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501 involve improper validation of IP traffic and can be triggered by crafted packets sent to an IP interface on the switch. All three require Next Generation OAM, or NGOAM, to be enabled, and CVE-2026-76486 additionally requires SRv6 or NV Overlay to be active.

CVE-2026-76465 is caused by improper handling of MPLS echo-request packets sent to the device's IP address. It requires MPLS OAM to be explicitly enabled, which is not the default, and it does not affect Nexus 9000 switches with Silicon One ASICs.

Nexus 7000 switches and Nexus 9000 switches in Application Centric Infrastructure, or ACI, mode are not affected by the five flaws.

SecurityWeek counted 14 NX-OS vulnerabilities in the batch, seven of them critical, including CVE-2026-76455 and CVE-2026-76459, which involve improper access control and out-of-bounds writes.

Why It Matters

Nexus switches sit at the core of many enterprise and cloud data center networks, so a flaw that gives an unauthenticated attacker root access can expose everything that passes through them. SecurityWeek reported that CVE-2026-76471 and CVE-2026-76465 can be exploited remotely without authentication.

The batch extends well beyond switches. Cisco License On-Prem received eight fixes, five of them critical, including CVE-2026-20328, which could lead to unauthorized access, and CVE-2026-76454, which allows a denial-of-service attack without authentication. Three more critical License On-Prem bugs involve missing authentication, improper signature verification and poorly protected credentials.

The Application Policy Infrastructure Controller, or APIC, received fixes for three critical flaws, CVE-2026-76498, CVE-2026-76499 and CVE-2026-76500, covering access control, operating system command injection and memory errors. Meraki security hardening updates address seven CVEs, led by CVE-2026-76464, a set of memory issues including buffer overflows. A high-severity server-side request forgery flaw in Cisco Finesse, CVE-2026-20362, had already been publicly disclosed before the fix.

Context

Cisco said it is not aware of any of the vulnerabilities being exploited in the wild. The release comes about a week after the company patched a zero-day in SD-WAN Manager that attackers were already using, a reminder that Cisco networking gear remains a frequent target.

What to Watch

Administrators should use Cisco's Software Checker to find the fixed NX-OS release for their hardware and confirm whether NX-API, NGOAM or MPLS OAM is enabled. Workarounds include disabling those features where they are not needed and applying temporary Live Protect shields to devices that cannot be upgraded right away. Security teams should also watch for proof-of-concept code, since none of the flaws are known to be exploited yet and public exploit details would shorten the window for patching.