As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76457 are related to out-of-bounds read issues that are grouped under the Common Weakness Enumeration (CWE) CWE-125.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76456 are related to improper input validation of special elements used in a command issue that are grouped under the Common Weakness Enumeration (CWE) CWE-20.
CVE-2026-76465 is a critical vulnerability in the MPLS OAM feature of Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending a crafted MPLS echo-request packet. The flaw arises from improper validation of these packets, potentially leading to process crashes and device reloads.
Cisco Jabber for Android versions before 15.3.1.311364 contain a path traversal vulnerability that allows a malicious app without permissions to write files into Jabber's private data directories. This is achieved by exploiting an exported activity and unsanitized input used in file path construction, enabling attackers to place attacker-controlled content in sensitive directories without user interaction.
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application.
This vulnerability is due to improper input validation and a lack of authentication in the management API. An attacker could exploit this vulnerability by sending a crafted request to the affected API. A successful exploit could allow the attacker to modify system files or cause a DoS condition.
CVE-2026-76453 is a high-severity vulnerability in Cisco NX-OS Software involving improper neutralization issues classified under CWE-707. Cisco conducted an internal security review leading to a software hardening release addressing multiple vulnerabilities, including this one. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No specific affected versions or patch information is provided in the available data.
A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system.
This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do.
CVE-2026-20362 is a Server-Side Request Forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse. It allows an unauthenticated remote attacker to send crafted HTTP requests that could lead to limited sensitive information disclosure from services associated with the affected device. The vulnerability arises from improper input validation of specific HTTP requests. It has a CVSS score of 7.2, indicating high severity. No patch or remediation information is currently provided.
A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read additional contents of the internal database of an affected application that should not normally be accessible to administrative users, thus impacting system confidentiality.
To exploit this vulnerability, the attacker must have valid administrative user credentials on the affected application.
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.
This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.
CVE-2026-20328 is a critical vulnerability in the web-based management interface of Cisco License On-Prem, formerly known as Cisco Smart Software Manager On-Prem. It arises from improper authorization checks during the password reset process. An unauthenticated remote attacker can exploit this flaw by sending a crafted request to reset the password of any account, including high-privileged administrative users. This could allow unauthorized access to the application with elevated privileges.
CVE-2026-20032 is a medium severity vulnerability in the Python interpreter of Cisco NX-OS Software. It allows an authenticated local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system. The issue arises from insufficient validation of user-supplied input, enabling manipulation of specific Python interpreter functions. Exploitation could lead to arbitrary command execution with the privileges of the authenticated user.