Cisco NX-OS: improper neutralization of input gives an authenticated low-privilege user full device compromise

CVSS 8.8CVE-2026-76453Firmware, BMC & network fabriccurated

Impact

A user who can already authenticate to the switch with low privileges escalates to full confidentiality, integrity and availability impact on the device (CVSS 8.8, PR:L). That turns a read-only or operator network account - the kind handed to monitoring, automation and NOC staff, and often shared via a service credential in a config management repo - into effective control of a leaf or spine carrying several tenants' traffic. Cisco found this in an internal hardening review and published no mechanism, so the affected CLI or API surface is unknown.

Who can reach it

Any user holding valid low-privilege credentials on an affected NX-OS device, over the network. Authentication is required; no user interaction. Includes automation and monitoring accounts.

What to do

Upgrade to a fixed NX-OS release per the Cisco hardening bulletin; no workaround is published. The upgrade reloads the switch, so plan a window per device with traffic moved to the redundant peer. In the meantime, audit which accounts hold NX-OS login - especially shared automation credentials - and remove any that do not need it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-76453 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.