The vulnerability is due to insufficient input validation of data sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device.
A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.
Cisco released software updates that address this vulnerability, according to an advisory. There are no workarounds.
This vulnerability affects the following Cisco products if they are running a vulnerable release of Cisco NX-OS Software and have the NX-API feature enabled:
- Nexus 3000 Series Switches
- Nexus 9000 Series Switches in standalone NX-OS mode
- UCS 6300 Series Fabric Interconnects
Disabled by Default
The NX-API feature ends up disabled by default for Cisco Nexus 3000 and 9000 Series Switches. For Cisco UCS 6300 Series Fabric Interconnects, exploitation of the vulnerability requires valid low-privileged user credentials and occurs through the Cisco UCS Manager XML API, enabled by default and cannot end up disabled without loss of functionality.
To determine if a Cisco Nexus 3000 or 9000 Series Switch ended up configured with the NX-API feature enabled, use the show feature | include nxapi command from the Cisco NX-OS CLI.
CVE-2026-76471 is the case number of the vulnerability, which has a CVSS base score of 9.8.
Cisco released a Live Protect shield for CVE-2026-76471 to temporarily mitigate this vulnerability for Cisco NX-OS Software.
For information about Live Protect for Cisco NX-OS Software, click on Cisco Nexus 9000 Series NX-OS Security Configuration Guide.
Live Protect shields are temporary mitigations to bridge the gap until software updates can end up scheduled.
Click here for additional security updates from Cisco.