DEV Community

StarkMan
StarkMan

Posted on

Four Critical NX-OS CVEs at Once: How to Order the Work

#cisco #nxos #cisconexus #networksecurity

Four Critical NX-OS CVEs at Once: How to Order the Work

Cisco published four critical NX-OS vulnerabilities together in October 2026. All four carry a CVSSv3 score of 9.8, all four allow code execution with root privileges, and none requires authentication. Identical severity scores are no help when deciding what to do on Monday morning. Configuration differences are.

Sorting by precondition

CVE-2026-76485 is the easiest to reach. It needs only that NGOAM is enabled on a Nexus 3000 or Nexus 9000 switch running standalone NX-OS. CVE-2026-76486 adds a requirement: NGOAM plus either SRv6 or an NV Overlay with an active VXLAN EVPN peer. CVE-2026-76501 needs NGOAM and SRv6 together. CVE-2026-76465 needs MPLS OAM, a feature that is off by default.

That ordering is also a rough priority order for any given device, because it reflects how many switches in a typical fleet satisfy the condition.

Sorting by reachability

Preconditions decide whether a device is exploitable. Network position decides how easily an attacker gets there. A switch that accepts traffic from untrusted tenants or from the internet is a different risk from one that only ever sees management traffic on a private segment. Combine the two dimensions and the target list becomes short and defensible.

Sorting by platform exclusions

Some devices drop out entirely. Nexus 9000 switches running in ACI mode are not affected, nor are Nexus 7000 switches, MDS 9000 storage switches, or several firewall and UCS product lines. On Nexus 3000 hardware, SRv6 is unsupported, which removes two of the three NGOAM variants from consideration. Checking exclusions first prevents wasted effort.

Where to start

The practical entry point is feature state. Two commands, show feature | include ngoam and show feature | include mpls_oam, separate the fleet into devices that can be exploited and devices that cannot. For everything in the first group, consult the Cisco Software Checker for the fixed release and schedule the upgrade. Cisco lists no true workarounds, though disabling an unused OAM feature removes the vector, and Live Protect shields are available as a temporary bridge.

The point of ordering

Four CVEs with the same score create the temptation to treat the whole fleet as one problem. The advisories actually describe a much smaller set of devices that are exposed today. Finding that set is faster than patching everything, and it is the step that should come first.

Sources

Top comments (0)