Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

Description

On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery . Cisco NX-OS Software Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco NX-OS Software Security Hardening Release: October 2026 CVE-2026-76455 CVE-2026-76456 CVE-2026-76457 CVE-2026-76459 CVE-2026-76458 CVE-2026-76453 Critical 9.8 Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability CVE-2026-76465 Critical 9.8 Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities CVE-2026-76485 CVE-2026-76486 CVE-2026-76501 Critical 9.8 Cisco NX-OS Software NX-API Remote Code Execution Vulnerability CVE-2026-76471 Critical 9.8 Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability CVE-2026-20038 Medium 5.8 Cisco NX-OS Software Control Plane Denial of Service Vulnerability CVE-2026-20173 Medium 5.8 Cisco NX-OS Software Python Sandbox Escape Vulnerability CVE-2026-20032 Medium 4.4 Cisco Application Policy Infrastructure Controller Cisco Security Advisory CVE ID Security Impact Rating Security Impact Rating: Informational

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Cisco NX-OS

CVE

CVE-2026-76455, CVE-2026-76456, CVE-2026-76457, CVE-2026-76459, CVE-2026-76458, CVE-2026-76453, CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76471, CVE-2026-20038, CVE-2026-20173, CVE-2026-20032

Affected versions

Cisco NX-OS Software 8.2: 12 versions, from 8.2(5) to 8.2(11)
Cisco NX-OS Software 7.3: 18 versions, from 7.3(5)D1(1) to 7.3(18)N1(1)
Cisco NX-OS Software 8.4: 22 versions, from 8.4(2) to 8.4(13)
Cisco NX-OS Software 9.2: 8 versions, from 9.2(3) to 9.2(1a)
Cisco NX-OS Software 9.3: 22 versions, from 9.3(2) to 9.3(17)
Cisco NX-OS Software 8.1: 5 versions, from 8.1(1) to 8.1(1a)
Cisco NX-OS Software 8.3: 8.3(2); 8.3(1)
Cisco NX-OS Software 8.5: 8.5(1)
Cisco NX-OS Software 10.3: 20 versions, from 10.3(1) to 10.3(9)
Cisco NX-OS Software 9.4: 9 versions, from 9.4(1) to 9.4(5)
Cisco NX-OS Software 10.4: 8 versions, from 10.4(1) to 10.4(7)
Cisco NX-OS Software 10.5: 11 versions, from 10.5(1) to 10.5(5)
Cisco NX-OS Software 10.6: 9 versions, from 10.6(1) to 10.6(3s)
Cisco NX-OS System Software in ACI Mode 15.2: 25 versions, from 15.2(1g) to 15.2(8i)
Cisco NX-OS System Software in ACI Mode 16.0: 20 versions, from 16.0(1g) to 16.0(9f)
Cisco NX-OS System Software in ACI Mode 15.3: 7 versions, from 15.3(1d) to 15.3(2f)
Cisco NX-OS System Software in ACI Mode 16.1: 7 versions, from 16.1(1f) to 16.1(5e)
Cisco NX-OS System Software in ACI Mode 16.2: 16.2(1g); 16.2(2e)
Cisco Unified Computing System (Managed) 4.0: 22 versions, from 4.0(1a) to 4.0(4o)
Cisco Unified Computing System (Managed) 4.1: 22 versions, from 4.1(1d) to 4.1(3n)
Cisco Unified Computing System (Managed) 4.2: 27 versions, from 4.2(1c) to 4.2(3s)
Cisco Unified Computing System (Managed) 4.3: 25 versions, from 4.3(2b) to 4.3(6i)
Cisco Unified Computing System (Managed) 6.0: 9 versions, from 6.0(1b) to 6.0(2d) (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

9.8

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

October 7, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.