Cisco NX-OS October 2026 hardening release fixes multiple critical and high severity flaws

What happened

The six flaws were found during Cisco's internal security review and fixed in an October 2026 software hardening release. CVE-2026-76455 is an improper access control issue and CVE-2026-76459 is an out-of-bounds write; both are rated critical with CVSS 3.1 scores of 9.8. In both cases, the affected component is reachable over the network, attack complexity is low, and exploitation requires no privileges and no user interaction, with high impact on confidentiality, integrity and availability. CVE-2026-76453, an improper neutralisation issue, is rated high at 8.8; it is network-based and low complexity, requires low privileges and no user interaction, and has high confidentiality, integrity and availability impact. CVE-2026-76456, CVE-2026-76457 and CVE-2026-76458 are rated high at 8.6; they require no privileges and no user interaction over the network and can cause a high availability impact. Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.

Who is affected

Affected products are Cisco NX-OS Software, Cisco NX-OS System Software in ACI Mode, and Cisco Unified Computing System (Managed). The affected NX-OS versions are 7.3(1)D1(1), 7.3(5)D1(1), 8.2(1), 8.2(5), 8.4(2), 8.4(3), 9.2(2v) and 9.2(3). The affected ACI mode versions are 15.2(1g), 15.2(2e), 15.2(2f), 15.2(2g), 15.2(2h), 15.2(3e), 15.2(3f) and 15.2(3g). The affected UCS Managed versions are 4.0(1a), 4.0(2b), 4.0(4a), 4.0(4c), 4.0(4e), 4.0(4f), 4.1(1d) and 4.1(2a); one vulnerability also lists 4.0(2e), 4.0(4g), 4.0(4h), 4.1(1a), 4.1(1b) and 4.1(1c) for UCS Managed.

What to do now

1. Apply the Cisco NX-OS security hardening release that Cisco identifies for your deployment. Confirm the correct fixed release for your product line (NX-OS, ACI mode or UCS Managed) from Cisco's advisory.
2. There are no workarounds that address these vulnerabilities, so do not rely on configuration changes as a substitute for patching.
3. If patching must be deferred, restrict access to management and data-plane interfaces, expose them only to trusted networks and monitor affected devices for unexpected changes or disruption.
4. Track Cisco's advisory for any further detail on the remediation and for the fixed versions applicable to your deployment.

Beyond the patch

NX-OS switches and UCS systems are infrastructure that is normally reachable from the network, and the critical flaws can be reached without credentials. This is the kind of exposed inbound surface that exposure management is designed to find before an advisory lands, so Virtual CISO Services (vCISO) is the fitting next step for inventorying and reducing network-reachable Cisco management interfaces. Supplier patch cycles define the window you are exposed, so Supply Chain Defense & Third-Party Risk can help track which Cisco software versions you run and how quickly the vendor ships fixes.