CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76455
Advisory Summary
🗓️ October 7, 2026
Cisco PSIRT published multiple security advisories on October 7, 2026, strongly recommending customers upgrade to the fixed software versions called out in each advisory. The disclosures focus heavily on Cisco NX-OS impacting core switching/control-plane behaviors, including several Critical remote code execution (RCE) conditions.
—
🚨 ⚠️ Highest Priority: Critical (CVSS 9.8)
These advisories represent the most urgent remediation work due to the potential for remote exploitation and high-impact outcomes.
🔹 Cisco NX-OS Software Security Hardening Release: October 2026
CVE IDs: CVE-2026-76455, -76456, -76457, -76458, -76459, -76453
Impact: Critical, CVSS 9.8
🔹 Nexus 3000/9000 Switches MPLS OAM RCE
CVE: CVE-2026-76465
Impact: Critical, CVSS 9.8
🔹 Nexus 3000/9000 Switches NGOAM RCEs
CVE IDs: CVE-2026-76485, -76486, -76501
Impact: Critical, CVSS 9.8
🔹 NX-OS NX-API RCE
CVE: CVE-2026-76471
Impact: Critical, CVSS 9.8
Action for operators: prioritize firmware/OS remediation for NX-OS platforms exposed to management, automation, or service planes associated with MPLS OAM / NGOAM / NX-API, and review access controls (management-plane reachability, ACLs, VRF exposure, and authenticated API access).
—
🟧 🛡️ Secondary (Medium) — Control Plane & Contract/Execution Boundaries
While lower than Critical, these still merit planned patching due to potential lateral movement, disruption, or policy bypass.
🔹 ACI Mode Endpoint Group Contract Bypass (Nexus 9000 Fabric Switches)
CVE: CVE-2026-20038
Impact: Medium, CVSS 5.8
🔹 NX-OS Control Plane DoS
CVE: CVE-2026-20173
Impact: Medium, CVSS 5.8
🔹 NX-OS Python Sandbox Escape
CVE: CVE-2026-20032
Impact: Medium, CVSS 4.4
Action for operators: validate whether you run ACI-mode policy interactions on Nexus 9000, and assess exposure of services that could stress control-plane components or interact with execution/sandbox mechanisms.
—
- RCE-heavy NX-OS set suggests attackers may target environments where service endpoints (OAM/NX-API) are reachable or where misconfigurations expand attack surface.
- Hardening release framing indicates Cisco likely bundled multiple related improvements—patching should be treated as a package-level upgrade path, not a single-CVE hotfix.
- Even Medium issues (e.g., contract bypass) can have outsized security consequences in segmented fabric environments.
—
✅ Recommended Immediate Steps
1. Inventory affected Cisco NX-OS versions and features (MPLS OAM, NGOAM, NX-API, ACI mode where applicable).
2. Map exposure paths: which VRFs/ACLs/management interfaces can reach these services from less-trusted networks.
3. Upgrade to fixed releases referenced by each PSIRT advisory (start with all CVSS 9.8 Critical items).
4. Track regression windows: schedule maintenance for control-plane stabilization and policy verification post-upgrade.
—
🔗
-OS -API
Reference: Vendor Advisory