Skip to content

Back to the catalog

lee1981 (@lee1981b) on X
x.comwriteup

lee1981 (@lee1981b) on X

A detailed "CVE of the Day" thread analyzing CVE-2026-76471, a critical (CVSS 9.8) Cisco advisory covering insufficient NX-API input validation (CWE-122 heap-based buffer overflow) on Nexus 3000/9000 standalone NX-OS and a lower-severity credentialed variant on UCS 6300 Fabric Interconnects via UCS Manager XML API. It compiles Cisco's fixed-software versions per platform, notes the temporary Live Protect shield lp00074, and walks through a six-step SOC evidence-preservation and correlation playbook (scoping affected devices, preserving logs/crash artifacts, reviewing API/shield telemetry, correlating device outcomes, remediating, and verifying post-patch state) while flagging that CISA KEV and FIRST EPSS had no data on the CVE at research time.

TL;DR Critical, no-auth RCE in Cisco Nexus NX-API (CVE-2026-76471, CVSS 9.8) with a separate credentialed UCS 6300 path — fixed releases, temporary shield lp00074, and a full SOC triage/evidence playbook.
Open original ↗
Document

What it is

CVE-2026-76471 (CVSS 3.1: 9.8 Critical, CWE-122 heap-based buffer overflow) in Cisco NX-API on Nexus 3000 and Nexus 9000 standalone NX-OS, with a separate lower-severity path on UCS 6300 Fabric Interconnects via UCS Manager XML API. Advisory ID: cisco-sa-napi-rce-r2shwu2j v1.0 Final, published 7 October 2026.

How it works

Insufficient NX-API input validation permits a heap-based buffer overflow, which Cisco describes as enabling root-level code execution or process failures that can reload the device and interrupt service. For Nexus, the base vector requires network access to the interface only — no prior credentials or user interaction. For UCS 6300, exploitation requires valid low-privileged credentials through the UCS Manager XML API (rated High severity by Cisco, not covered by the 9.8 score).

Preconditions / Affected

  • Nexus: affected release AND NX-API enabled (disabled by default, but deployment-dependent). Excluded: Nexus 9000 ACI mode, Nexus 7000, MDS 9000, UCS 6400/6500/6600.
  • UCS 6300: XML API is enabled by default and cannot be disabled without losing functionality.
  • CISA KEV (catalogue version 2026.10.04, 1,734 entries) has no match; FIRST EPSS has no score. Cisco states no workaround exists — only fixed software resolves it.

What to do

Example fixed versions Cisco returned for four Nexus 9000 queries (not universal — verify per platform/train via Cisco's Software Checker):

10.3(9) → 10.3(10)
10.4(7) → 10.4(8)
10.5(5) → 10.5(6)
10.6(3) → 10.6(4)

UCS 6300 4.3 fixes:

UCS Manager Managed: 4.3(6j)
Intersight Managed: 4.3(6.260049)

4.2 and earlier must migrate to a fixed release.

Temporary mitigation: Cisco's Live Protect shield lp00074 (policy name cve-nxapi-rce) on supported Nexus hardware running 10.6(3) only — confirm hardware compatibility and effective policy mode; it monitors/alerts but enforcement is limited to supported scope, and it becomes N/A after upgrading to 10.6(4)+.

Detection/correlation: watch for the shield's critical-threat alert tied to policy cve-nxapi-rce, and correlate with device resets, crash artifacts, and unexpected NX-API/XML-API client activity on the same asset and time window.

Caveats

Cisco states it is unaware of public announcements or malicious use (discovery via internal testing). No exploit code, IOC, hash, or actor was established. A shield alert or reload is a lead, not proof of successful exploitation — package presence/monitoring does not equal enforcement. Defect tracking IDs (CSCwu46202, CSCwu46199, CSCwu58579) are referenced across CNA/advisory/shield without a confirmed complete mapping.

CVEs named here

Technologies named here

Related in Cloud & Infra