External risk intelligence

Cisco NX-OS NX-API Code Execution and DoS Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76471

The NX-API feature in Cisco NX-OS is an interface designed to provide programmatic access to network devices, often exposed over HTTP/HTTPS. Because this API is a primary management and integration endpoint for network infrastructure, it is frequently configured to be reachable for remote administration or automation, making it a public-facing or edge-reachable service by design in many common deployments.

Denial of Service

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Cisco NX-OS Software's NX-API feature allows unauthenticated remote attackers to execute code or disrupt service by sending a specially crafted HTTP request. This could lead to unauthorized access with root privileges or a denial of service condition due to insufficient input validation.

Attackers can run code or crash network devices.
This affects a core network management interface.
Confirm relevance and potential exposure to this threat.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could target the NX-API feature of Cisco NX-OS Software by sending a specially crafted HTTP request. This request exploits a flaw in how the API handles input data, potentially allowing the attacker to gain root-level control or disrupt the device's operations.

No authentication required.
Vulnerable NX-API input validation.
Arbitrary code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Cisco NX-OS's NX-API could allow an attacker to execute arbitrary code with root privileges or cause a denial of service on an affected device when supported by the advisory. This is possible by sending a crafted HTTP request to the NX-API, potentially leading to process crashes and device reloads.

Network device operating system could be affected.
Unauthenticated HTTP requests to NX-API.
Root access or denial of service may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Cisco NX-OS Software's NX-API impacts network infrastructure, likely managed by infrastructure, platform, and network/security teams. The first action is to identify all NX-API enabled devices, assess their exposure and business criticality, and confirm the responsible owner for remediation planning.

Network and infrastructure teams own remediation.
Verify NX-API reachability and criticality.
Plan and execute fixes during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco NX-OS Software and the NX-API feature?

Cisco NX-OS is the operating system powering Cisco's data center and core networking switches. The NX-API is a management interface within this system that allows administrators to programmatically automate tasks and configure devices using standard HTTP or HTTPS requests, acting as a gateway for remote control and data integration.

How does CVE-2026-76471 allow code execution?

This vulnerability stems from a weakness known as CWE-122, which relates to memory management errors. Because the NX-API fails to properly check the format and length of incoming data, an attacker can send a specifically designed HTTP request that overwhelms the system's memory. This forces the device to execute unauthorized commands at the root level or crash entirely.

Do I need to be logged in to trigger this vulnerability?

No, authentication is not required to trigger this flaw. The vulnerability is accessible to any remote party capable of sending an HTTP request to the device. Note that simply having the NX-OS software installed is not enough to be vulnerable; the specific NX-API feature must be actively enabled and reachable for the exploit to occur.

How do I know if my devices are at risk?

According to Halo Surface Signal, this vulnerability is a high priority because the NX-API is frequently configured as an internet-facing or edge-reachable service to support remote automation. If your network switches have this interface exposed to untrusted segments or the public internet, they are at a much higher risk of being targeted by remote attackers.

What is the first step to address this CVE?

You should immediately audit your infrastructure to identify which network devices have the NX-API feature enabled. Once mapped, assess whether this access is strictly necessary for current operations and verify which teams are responsible for managing these specific devices to begin coordinating a formal update or configuration change.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.