Cisco patches four critical NX-OS flaws with CVSS 9.8

Cisco released fixes in October 2026 for four critical NX-OS vulnerabilities, all rated CVSS 9.8 and allowing unauthenticated root-level code execution. Exploitability depends on enabled features such as NGOAM, SRv6, VXLAN EVPN or MPLS OAM; Nexus 9000 switches in ACI mode and Nexus 7000 are not affected.

• All four CVEs score 9.8 and allow unauthenticated root code execution
• CVE-2026-76485 needs only NGOAM enabled on Nexus 3000/9000
• CVE-2026-76465 requires MPLS OAM, which is off by default
• Nexus 9000 in ACI mode and Nexus 7000 are not affected