Cisco NX-OS October 2026 hardening release fixes improper access control and other flaws

What happened

Cisco's NX-OS engineering team ran an internal security review and produced the October 2026 security hardening release. CVE-2026-76455 is an improper access control issue rated Critical with a CVSS score of 9.8. It is reachable over the network with low attack complexity, requires no privileges and no user interaction, and can compromise confidentiality, integrity and availability of the affected device.

The same release addresses five further vulnerabilities. CVE-2026-76453 and CVE-2026-76459 are improper neutralization and out-of-bounds write issues respectively. Both have a CVSS score of 8.8, are reachable over the network and require low privileges. CVE-2026-76456, CVE-2026-76457 and CVE-2026-76458 are an improper input validation, an out-of-bounds read and an improper handling of exceptional conditions. Each has a CVSS score of 8.6, requires no privileges, and can cause a high availability impact.

Cisco PSIRT says it is not aware of any public announcements or malicious use of these vulnerabilities. They were internally discovered and not publicly disclosed before the advisory.

Who is affected

Cisco lists affected builds for three product lines. For Cisco NX-OS Software, the affected builds are 8.2(5), 7.3(5)D1(1), 8.4(2), 8.4(3), 9.2(3), 8.2(1), 7.3(1)D1(1) and 9.2(2v). For Cisco NX-OS System Software in ACI Mode, affected builds are 15.2(1g), 15.2(2e), 15.2(2f), 15.2(2g), 15.2(2h), 15.2(3f), 15.2(3e) and 15.2(3g). For Cisco Unified Computing System (Managed), the affected builds are in the 4.0 and 4.1 families; CVE-2026-76456 has a slightly different UCS build list, so check that entry against your installed version. These are data centre switches, ACI fabrics and UCS management platforms.

What to do now

1. Apply Cisco's October 2026 NX-OS security hardening release. Cisco states fixes are available, but has not listed specific fixed release numbers in its advisory; use Cisco's advisory to map your product train and platform to the correct fixed release.
2. Do not wait for a workaround. Cisco states there are no workarounds that address these vulnerabilities.
3. Restrict access to NX-OS, ACI and UCS management interfaces to trusted management networks while you schedule and complete patching.
4. After patching, verify the release on each affected device and re-check the CVE entries against your asset inventory, since one CVE lists a different UCS build set.

How to detect it

Cisco's advisory does not publish indicators of compromise for these internally discovered vulnerabilities. Until the hardening release is applied, monitor NX-OS, ACI and UCS management interfaces for unexpected configuration changes, new administrative accounts or unplanned reloads.

Beyond the patch

With no workaround available, your exposure ends only when the hardening release is applied. Supply Chain Defense & Third-Party Risk can give you visibility into Cisco's patch cycle and your own window of exposure across the network estate, while Virtual CISO Services (vCISO) helps you control reachable management interfaces and sequence data centre patching.