CVE-2026-76471 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
Unauthenticated remote attackers can execute arbitrary code with root privileges or cause denial of service on Cisco NX-OS devices via crafted NX-API requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76471?
CVE-2026-76471 is a critical command injection vulnerability in Cisco NX-OS Software, published on 7 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of data that is sent to the NX-API. An attacker could exploit this vulnerability by sending a crafted HTTP request to the NX-API of an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a reload of the device and a DoS condition.
Weakness: CWE-122
Which versions are affected by CVE-2026-76471?
How do I fix CVE-2026-76471?
No fix has been published for CVE-2026-76471 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-76471 being exploited?
There is no known exploitation of CVE-2026-76471 in the wild and no public exploit code.
Sources
Also known as GHSA-cw8g-p542-fwjp.