Cisco publishes critical (CVSS 9.8) fixes for NX-OS, Nexus 3000/9000 switches and APIC
Data-centre switching and fabric controllers sit underneath most other controls, so a compromise at this layer can undermine segmentation across an entire environment. Network teams should inventory affected NX-OS and APIC versions, confirm whether management APIs are reachable from untrusted networks, and schedule emergency change windows rather than waiting for routine cycles. Organisations relying on managed service providers should ask for written confirmation of patch status.
What Happened
Cisco's Product Security Incident Response Team published a batch of security advisories on 7 October 2026, including critical issues scored CVSS 9.8. These cover remote code execution flaws in NX-OS NX-API and in MPLS OAM and NGOAM on Nexus 3000 and 9000 Series switches, and API command injection in the Application Policy Infrastructure Controller. Cisco strongly recommends upgrading to the fixed software listed in each advisory.
Why It Matters
Data-centre switching and fabric controllers sit underneath most other controls, so a compromise at this layer can undermine segmentation across an entire environment. Network teams should inventory affected NX-OS and APIC versions, confirm whether management APIs are reachable from untrusted networks, and schedule emergency change windows rather than waiting for routine cycles. Organisations relying on managed service providers should ask for written confirmation of patch status.
Sources
- Cisco (opens in a new tab): Cisco Security Advisory: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories (2026-10-07)
More From This Briefing
- Google contracts 3,590MW from Constellation in PJM, including 890MW of new nuclear output
- EU AI Act: Article 50 transparency rules now apply; content marking due December 2026, high-risk rules December 2027
- Anthropic launches Claude Haiku 5.5, saying it costs about 75% less on average to run than Haiku 4.5
- BMA AI guidance consultation closes 30 October as regulator runs World Investor Week webinar
This story is part of the Laurenceo Intelligence briefing for 8 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.