CVE-2026-76459 is a critical (CVSS 9.8) out-of-bounds write class in Cisco NX-OS Software, found in an internal review. It covers Nexus, MDS and UCS fabric interconnect platforms, with no workaround. Cisco published first fixed releases for each train, so upgrade to the one for your platform.
What's affected
- Product: Cisco NX-OS on MDS 9000, Nexus 3000, 7000 and 9000 (standalone and ACI mode), and UCS 6300, 6400, 6500, 6600 and X-Series Direct 9108 100G fabric interconnects.
- Affected: vulnerable releases regardless of configuration.
- Weakness: CWE-787, out-of-bounds write. This CVE groups several internally found issues of that class, including stack and heap buffer overflows.
- CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Cisco says the issues were found in internal testing and are not known to be actively exploited. Not listed in CISA KEV.
First fixed releases from the advisory:
- MDS 9000: 9.4 train 9.4(5a). 9.3 and earlier must migrate to a fixed release.
- Nexus 3000 and 9000 standalone: 10.3(10), 10.4(8), 10.5(6) and 10.6(4).
- Nexus 7000: 8.4(14). 8.3 and earlier must migrate.
- Nexus 9000 ACI mode: 16.0(9h), 16.1(6g) and 16.2(3g).
- UCS fabric interconnects, UCS Manager managed mode: 4.3(6j) and 6.0(2e). Intersight managed mode: 4.3(6.260049) and 6.0(2.260080). 4.3(6.260059) is for the Cisco 9108 100G only. 4.2 and earlier must migrate.
Check the advisory for the full table before you plan an upgrade, as the train you run decides the target.
How to check if you're exposed
On each device, read the running version.
switch# show version
Compare it with the table above, per platform and train. For UCS, check the UCS Manager or Intersight version for the managed mode you use. Cisco also lists three Snort rules on the advisory page, which help you watch for related traffic while you plan the upgrade.
What to do now
- Inventory NX-OS devices and their versions, grouped by platform and train.
- Pick the first fixed release for each train, and read the release notes for upgrade paths. Trains listed as "migrate" need a move to a supported train.
- Restrict management plane access to a dedicated network while you wait.
- Schedule the upgrades in maintenance windows, starting with devices that face less trusted networks.
- Confirm the version afterwards with
show version, and record it.
Why it matters
An out-of-bounds write lets code write past the end of a buffer. In network operating systems written largely in C, that class covers stack and heap overflows and wrong size calculations, and the CVSS vector here shows a network attack with no login and no user action.
The advisory notes that Cisco found these with its existing testing and frontier AI models. The practical lesson is cadence. Vendors now ship grouped hardening releases, so plan for larger, more frequent infrastructure upgrade windows.
Quick check
Do I need a particular configuration to be affected?
No. Cisco says the platforms are affected if they run a vulnerable release, regardless of device configuration.
Why is the CVSS score 9.8?
The score reflects the most severe single issue in the group, as Cisco explains in the advisory.
Sources
Last reviewed: 19 October 2026.
