TI-2026-69231 Aliases CVE-2026-76471 GHSA-cw8g-p542-fwjp

Remote code execution in Cisco NX-OS NX-API

MEDIUM 49CWE-122Published 2026-10-07 · Updated 2026-10-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Cisco NX-OS Software and Cisco Unified Computing System (Managed) are affected, with listed releases starting from 9.2(1) and 4.0(1a). Insufficient input validation of data sent to the NX-API leads to a heap-based buffer overflow (CWE-122). An unauthenticated remote attacker who sends a crafted HTTP request can execute arbitrary code as root or crash processes, causing a device reload and denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.  The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00486 42nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco NX-OS Software	9.2(3); 9.2(2v); 9.2(1); 9.2(2t); 9.2(3y); 9.3(2); 9.2(4); 9.3(1); 9.3(1z); 9.2(2); 9.3(3); 9.3(4); 9.3(5); 9.3(6); 9.3(5w); 9.3(7); 9.3(7k); 9.3(7a); 9.3(8); 9.3(9); 9.3(10); 10.3(1); 10.3(2); 9.3(11); 10.3(3); 9.3(12); 10.4(1); 10.3(99w); 10.3(3w); 10.3(99x); 10.3(3o); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 10.3(5); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.5(2); 10.3(7); 10.4(5); 10.5(3); 9.3(15); 10.4(4g); 10.5(4); 10.6(1); 10.5(3t); 10.3(8); 10.4(6); 10.5(3s); 10.5(3e); 10.5(3o); 9.3(16); 10.6(1s); 10.6(2); 10.5(3p); 10.3(9); 10.6(2s); 10.6(3); 10.4(7); 10.5(5); 9.3(17); 10.6(2n); 10.6(3s)	—	No fix listed	CNA
Cisco	Cisco Unified Computing System (Managed)	4.0(1a); 4.1(1d); 4.0(4f); 4.0(4a); 4.0(4e); 4.0(4c); 4.0(4h); 4.1(1c); 4.0(2a); 4.1(1e); 4.1(2a); 4.0(2b); 4.0(1b); 4.0(4d); 4.0(2e); 4.1(1a); 4.0(4g); 4.0(1c); 4.0(1d); 4.0(4b); 4.0(4i); 4.0(2d); 4.1(1b); 4.1(2b); 4.0(4k); 4.1(3a); 4.1(3b); 4.1(2c); 4.0(4l); 4.1(4a); 4.1(3c); 4.1(3d); 4.2(1c); 4.2(1d); 4.0(4m); 4.1(3e); 4.2(1f); 4.1(3f); 4.2(1i); 4.1(3h); 4.2(1k); 4.2(1l); 4.0(4n); 4.2(1m); 4.1(3i); 4.2(2a); 4.2(1n); 4.1(3j); 4.2(2c); 4.2(2d); 4.2(3b); 4.1(3k); 4.0(4o); 4.2(2e); 4.2(3d); 4.2(3e); 4.2(3g); 4.1(3l); 4.3(2b); 4.2(3h); 4.2(3i); 4.3(2c); 4.1(3m); 4.3(2e); 4.3(3a); 4.2(3j); 4.3(3c); 4.3(4a); 4.2(3k); 4.3(4b); 4.3(4c); 4.2(3l); 4.3(4d); 4.3(2f); 4.2(3m); 4.3(5a); 4.3(4e); 4.1(3n); 4.3(4f); 4.2(3n); 4.3(5c); 4.2(3o); 4.3(5d); 4.3(6a); 4.3(6b); 4.3(5e); 4.3(6c); 4.2(3p); 4.3(6d); 4.3(6e); 4.3(6f); 4.2(3r); 4.3(6g); 4.3(6h); 4.2(3s); 4.3(6i)	—	No fix listed	CNA

Cisco NX-OS Software VendorCisco Affected 9.2(3); 9.2(2v); 9.2(1); 9.2(2t); 9.2(3y); 9.3(2); 9.2(4); 9.3(1); 9.3(1z); 9.2(2); 9.3(3); 9.3(4); 9.3(5); 9.3(6); 9.3(5w); 9.3(7); 9.3(7k); 9.3(7a); 9.3(8); 9.3(9); 9.3(10); 10.3(1); 10.3(2); 9.3(11); 10.3(3); 9.3(12); 10.4(1); 10.3(99w); 10.3(3w); 10.3(99x); 10.3(3o); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 10.3(5); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.5(2); 10.3(7); 10.4(5); 10.5(3); 9.3(15); 10.4(4g); 10.5(4); 10.6(1); 10.5(3t); 10.3(8); 10.4(6); 10.5(3s); 10.5(3e); 10.5(3o); 9.3(16); 10.6(1s); 10.6(2); 10.5(3p); 10.3(9); 10.6(2s); 10.6(3); 10.4(7); 10.5(5); 9.3(17); 10.6(2n); 10.6(3s) Fixed in — No fix listed CNA
Cisco Unified Computing System (Managed) VendorCisco Affected 4.0(1a); 4.1(1d); 4.0(4f); 4.0(4a); 4.0(4e); 4.0(4c); 4.0(4h); 4.1(1c); 4.0(2a); 4.1(1e); 4.1(2a); 4.0(2b); 4.0(1b); 4.0(4d); 4.0(2e); 4.1(1a); 4.0(4g); 4.0(1c); 4.0(1d); 4.0(4b); 4.0(4i); 4.0(2d); 4.1(1b); 4.1(2b); 4.0(4k); 4.1(3a); 4.1(3b); 4.1(2c); 4.0(4l); 4.1(4a); 4.1(3c); 4.1(3d); 4.2(1c); 4.2(1d); 4.0(4m); 4.1(3e); 4.2(1f); 4.1(3f); 4.2(1i); 4.1(3h); 4.2(1k); 4.2(1l); 4.0(4n); 4.2(1m); 4.1(3i); 4.2(2a); 4.2(1n); 4.1(3j); 4.2(2c); 4.2(2d); 4.2(3b); 4.1(3k); 4.0(4o); 4.2(2e); 4.2(3d); 4.2(3e); 4.2(3g); 4.1(3l); 4.3(2b); 4.2(3h); 4.2(3i); 4.3(2c); 4.1(3m); 4.3(2e); 4.3(3a); 4.2(3j); 4.3(3c); 4.3(4a); 4.2(3k); 4.3(4b); 4.3(4c); 4.2(3l); 4.3(4d); 4.3(2f); 4.2(3m); 4.3(5a); 4.3(4e); 4.1(3n); 4.3(4f); 4.2(3n); 4.3(5c); 4.2(3o); 4.3(5d); 4.3(6a); 4.3(6b); 4.3(5e); 4.3(6c); 4.2(3p); 4.3(6d); 4.3(6e); 4.3(6f); 4.2(3r); 4.3(6g); 4.3(6h); 4.2(3s); 4.3(6i) Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:cisco:nx-os::::::::	—	—	Cisco

cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:* Versions — — ·Cisco

Remediation

The sources list no fixed version for Cisco NX-OS Software. The sources list no fixed version for Cisco Unified Computing System (Managed).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-07 Threatist record created from CVE-2026-76471
2026-10-07 CISA SSVC decision points changed
2026-10-07 Alias added: GHSA-cw8g-p542-fwjp
2026-10-08 CISA SSVC decision points changed

References

Other 1

cisco-sa-napi-rce-r2shwu2j

TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0

See all 7059 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences