Cisco discloses multiple critical 9.8-rated flaws in NX-OS, Nexus 3000/9000 switches and APIC
Nexus switching and APIC sit at the centre of many data centre fabrics, so a compromise there gives an attacker a vantage point over everything they carry. Read alongside today's allied advisory on edge-device targeting, these flaws warrant emergency change windows rather than routine patch cycles. Teams should start by confirming that NX-API and management interfaces are not reachable from untrusted networks.
What Happened
On 7 October 2026, Cisco PSIRT published a batch of security advisories. They include critical, CVSS 9.8 remote code execution vulnerabilities in Cisco NX-OS Software, Nexus 3000 and 9000 Series Switches (MPLS OAM and NGOAM) and the NX-API, plus critical API command injection vulnerabilities in the Cisco Application Policy Infrastructure Controller. Cisco strongly recommends that customers upgrade to the fixed software.
Why It Matters
Nexus switching and APIC sit at the centre of many data centre fabrics, so a compromise there gives an attacker a vantage point over everything they carry. Read alongside today's allied advisory on edge-device targeting, these flaws warrant emergency change windows rather than routine patch cycles. Teams should start by confirming that NX-API and management interfaces are not reachable from untrusted networks.
Sources
- Cisco (opens in a new tab): Cisco Security Advisory: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories (2026-10-07)
More From This Briefing
- US and allied agencies tie China-based Integrity Tech to global intrusions as FBI seizes linked domains
- OpenAI brings GPT-6 Sol and Luna to all ChatGPT plans, rated High capability in cyber and bio
- Anthropic releases Claude Haiku 5.5, cutting small-model running costs by about 75% on average
- GlobalFoundries signs $2bn, five-year deal to make CoWoS silicon interposers for TSMC in New York
This story is part of the Laurenceo Intelligence briefing for 9 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.