Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
Plan PatchCVSS 9.8cisco-sa-napi-rce-r2shwu2jOct 7, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending a crafted HTTP request. The vulnerability results from insufficient input validation of data sent to the NX-API. Successful exploitation could allow the attacker to run arbitrary commands with root privileges, crash processes, or force a device reload.
What this means
What could happen
An attacker could execute arbitrary commands with root privileges on a Nexus switch, allowing them to alter network traffic flow, disable security controls, or crash the device and disrupt network operations. A successful exploit could also cause a denial of service that forces the switch to reload.
Who's at risk
Organizations running Cisco Nexus 3000 or 9000 Series Switches with the NX-API feature enabled should care about this vulnerability. These switches are critical to data center and enterprise network operations; compromising them could allow an attacker to redirect traffic, inject malicious content, or disable network connectivity.
How it could be exploited
An attacker sends a specially crafted HTTP request to the NX-API service on a vulnerable switch (typically port 443 or 8443). The NX-API fails to properly validate the request input, allowing the attacker to inject malicious commands that execute with root privileges on the device.
Prerequisites
- Network access to the NX-API port on the affected switch (typically HTTPS port 443 or 8443)
- NX-API feature must be enabled on the device
Remotely exploitableNo authentication requiredLow complexityAffects critical network infrastructureRoot-level code executionHigh CVSS score (9.8)
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
Cisco NX-OS Software NX-API4.0(1a) through 4.3(6i)Fix available
Nexus 3000 Series SwitchesAll versionsFix available
Nexus 9000 Series SwitchesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/2WORKAROUNDDisable the NX-API feature if it is not required for your network management workflow
HARDENINGRestrict network access to the NX-API port (443/8443) using firewall rules or access control lists; allow only trusted management hosts
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate NX-OS Software to a patched version that addresses CVE-2026-XXXXX (consult Cisco advisory for exact version numbers for your Nexus series)
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate switch management traffic from untrusted network segments
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/d974222d-a8bc-414b-95d0-bf7d13932c79Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.