Cisco Fixes Critical NX-OS NX-API Remote Code Execution Vulnerability

Cisco has released software updates to address a critical remote code execution vulnerability in its NX-OS Software. The flaw, tracked as CVE-2026-76471, affects the NX-API feature and allows unauthenticated, remote attackers to execute arbitrary code with root privileges or cause a denial of service condition on affected devices.

The vulnerability stems from insufficient input validation of data sent to the NX-API. An attacker can exploit this weakness by sending a crafted HTTP request to the NX-API interface of a vulnerable device. A successful exploit grants the attacker the ability to run arbitrary code with root-level access. Additionally, the exploitation can trigger process crashes, leading to a device reload and resulting in a denial of service. Cisco has assigned a Critical security impact rating to this advisory.

Context and Background

This advisory was published as part of a group of security notices released by Cisco on October 7, 2026. The company provided a complete list of the advisories and links in its Advance Notification for Publication of October 7, 2026, Security Advisories. For further documentation regarding improvements and fixes in Cisco NX-OS Software, users can refer to the Cisco NX-OS Software Security Hardening Release: October 2026.

The Microsoft Security Update Guide also updated an acknowledgement for CVE-2026-71343, a Windows Remote Access Connection Manager remote code execution vulnerability. Microsoft described this change as informational only, with no indication of a new fix or severity change in the provided summary.

Who Is Affected

The vulnerability specifically impacts devices running Cisco NX-OS Software with the NX-API feature enabled. The advisory does not specify a list of affected hardware models in the provided text, but the risk applies to any installation where the NX-API is accessible and the software version is vulnerable. Because the attack vector is remote and unauthenticated, any device exposed to networks where attackers can send HTTP requests to the NX-API endpoint is at risk.

What should you do?

Cisco has released software updates that address this vulnerability. Administrators should apply the latest software patches immediately to protect their infrastructure. Cisco explicitly states that there are no workarounds that address this vulnerability. Therefore, applying the software update is the only confirmed mitigation strategy. Users should consult the specific advisory link provided by Cisco for detailed instructions on the affected versions and the corresponding fixed releases.