CVE-2026-76471: check NX-API exposure before patching
Cisco rates this NX-API flaw Critical (CVSS 9.8). The remote unauthenticated path applies to Nexus 3000 and standalone Nexus 9000 only when NX-API is enabled. Cisco says the feature is disabled by default. UCS 6300 has a separate credentialed path.
Think of NX-API as a loading dock with an intake checklist. Opening the dock makes the route reachable, but staff still need to check each package against the rules before handing it to machinery. Cisco says NX-API does not validate input sufficiently; a crafted HTTP request may cause code execution or a crash. Cisco has not published the vulnerable code or the exact failed check, so this analogy explains missing validation, not the implementation. The Nexus route also requires a vulnerable release; UCS 6300 uses a distinct, credentialed path.
| Product and mode | Exposure condition | Operator action |
|---|---|---|
| Nexus 3000, standalone NX-OS | Affected only when the device runs a vulnerable release and NX-API is enabled; Cisco says NX-API is disabled by default. The documented CVSS vector is unauthenticated network access. | Run `show feature | include nxapi`. If enabled, check CVE-2026-76471 in Cisco Software Checker with the exact platform and release; schedule the returned First Fixed version. |
| Nexus 9000, standalone NX-OS | Same vulnerable release and enabled-NX-API conditions as Nexus 3000. Do not apply this row to Nexus 9000 in ACI mode. | Run the same read-only feature check, then use the exact model and software release in Cisco Software Checker. |
| UCS 6300 Fabric Interconnect | Affected on a Cisco-listed vulnerable UCS release when accessed with valid low-privilege credentials through UCS Manager XML API; Cisco says this API is enabled by default and cannot be disabled without loss of function. Cisco rates this case High. | Cisco advisory v1.1 lists UCS 4.3(6j) as fixed; releases 4.2 and earlier must migrate. Confirm applicability in its UCS table. Do not apply the unauthenticated Nexus vector. |
| Other products / modes | Cisco lists Nexus 9000 in ACI mode and several other product families as not affected by this advisory. | Confirm the exact product and operating mode against Cisco’s Vulnerable and Not Vulnerable sections. |
How to check exposure and choose the right fix
Record the exact device identity
Capture the product family, model, operating mode (standalone NX-OS or ACI), and installed release. Do not infer exposure from “Nexus” alone.
Check the feature state on Nexus
Run `show feature | include nxapi` from the NX-OS CLI. Cisco’s enabled example includes `nxapi 1 enabled`; an enabled feature meets the Nexus exposure condition.
Resolve the exact first-fixed release
In Cisco Software Checker, select this advisory, the correct software and platform, and enter the installed release. Record the returned First Fixed release for that combination. The advisory was updated October 8; avoid copied release ranges that do not identify the platform.
Upgrade; treat the shield as temporary
Cisco says there is no workaround that fixes the flaw. Upgrade to the checker’s applicable fixed release. The Live Protect shield can bridge scheduling only; it is not a permanent fix. Keep UCS 6300 on its separate remediation path.
- Inventory Nexus 3000 and Nexus 9000 devices and record model, mode, and NX-OS release.
- Run `show feature | include nxapi` on standalone Nexus devices; investigate every enabled result against the advisory.
- Use Cisco Software Checker for the exact product, platform, and release before selecting a target version. Preserve the result in the change record.
- For UCS 6300, verify UCS Manager versus Intersight management and use the UCS-specific fixed release information in advisory v1.1.
- Do not describe Live Protect as a fix or claim exploitation in the wild; Cisco reports no known malicious use in the advisory.