A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.
Metrics
Affected Vendors & Products
References
History
Sun, 11 Oct 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco nx-os Software Cisco unified Computing System Manager |
|
| Vendors & Products |
Cisco
Cisco nx-os Software Cisco unified Computing System Manager |
Wed, 07 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 07 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition. | |
| Title | Cisco NX-OS Software NX-API Remote Code Execution Vulnerability | |
| Weaknesses | CWE-122 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: cisco
Published: 2026-10-07T16:15:35.076Z
Updated: 2026-10-08T03:55:32.792Z
Reserved: 2026-08-19T12:02:03.638Z
Link: CVE-2026-76471
Updated: 2026-10-07T17:46:08.443Z
Status : Awaiting Analysis
Published: 2026-10-07T17:17:00.230
Modified: 2026-10-08T20:08:45.857
Link: CVE-2026-76471
No data.