On October 7, 2026, NVD published two critical Cisco CVEs that have nothing in common technically but share the same practical problem: NVD gives no list of affected versions. For both, Cisco's advisory is the only source that tells you whether you're affected.
- CVE-2026-76459 (9.8): a batch of out-of-bounds writes in Cisco NX-OS, found during an internal review.
- CVE-2026-76454 (9.1): an unauthenticated API in Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem).
| CVE | Product | CVSS 3.1 | Vector | NVD published | CISA KEV |
|---|---|---|---|---|---|
| CVE-2026-76459 | Cisco NX-OS | 9.8 (CRITICAL) | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | 2026-10-07 | no (as of writing) |
| CVE-2026-76454 | Cisco License On-Prem | 9.1 (CRITICAL) | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | 2026-10-07 | no (as of writing) |
Cisco NX-OS — CVE-2026-76459
What NVD says
The description is unusual. It doesn't describe a flaw, it describes a process:
the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The flaws grouped under CVE-2026-76459 all fall under CWE-787 (out-of-bounds write). Cisco assigned one identifier per weakness category rather than one per bug.
What we don't know
To be plain about it: we don't know the affected components, the exploitation conditions, or which Nexus platforms are affected. The AV:N/PR:N vector says at least one of these flaws is considered reachable remotely without authentication, but not through which service. NVD publishes no version bounds.
Why it still needs handling
An out-of-bounds write in a network operating system is the class of flaw that leads to code execution or a device crash. On a datacenter core switch, a crash is already a major incident. And an internal review producing a "hardening release" means several defects are fixed at once: once the fix is public, diffing versions becomes a source of information for anyone trying to find them.
Versions
NVD publishes no affected or fixed versions as of writing. Use the Cisco Software Checker and the matching Cisco advisory to find the hardening release for your platform and software train.
Cisco License On-Prem — CVE-2026-76454
What the flaw does
Cisco License On-Prem is the locally installed licensing server for environments that can't talk directly to Cisco's cloud. The flaw is in its Smart Licensing Utility API:
This vulnerability is due to improper input validation and a lack of authentication in the management API.
An unauthenticated remote attacker could write arbitrary files to the system or cause a denial of service. The vector shows no confidentiality impact (C:N), but high integrity and availability impact.
Why it matters
Writing arbitrary files on a server is often the first step toward code execution, depending on what can be overwritten. And an unavailable licensing server eventually means Cisco devices that can no longer validate their licenses. This kind of server rarely gets attention: it's installed, it runs, nobody looks at it.
Versions
NVD publishes no affected or fixed versions as of writing. Refer to Cisco's advisory for the License On-Prem release to install.
Detection
NX-OS:
- Accurate inventory of NX-OS versions per device (
show version), checked against Cisco's advisory. - Unexpected reloads, core dumps or process crashes in system logs.
- Management services reachable beyond the admin network.
License On-Prem:
- Access to the management interface and API from addresses outside the admin network.
- Recently modified files on the system outside updates.
- Unexplained service stops or restarts.
Mitigation
- Identify the fixed release with the Cisco Software Checker for each NX-OS platform, and schedule the upgrade first on devices whose management services are most exposed.
- Restrict access to NX-OS management planes (SSH, NX-API, SNMP) with ACLs limited to the admin network.
- Update Cisco License On-Prem to the release Cisco specifies.
- Isolate License On-Prem: its interface and API should only be reachable from the admin network. There's no reason for it to be reachable from the internet.
- If you suspect License On-Prem was compromised: rebuild the server from a clean image rather than hunting modified files one by one.
Why Continuous Monitoring of Network Gear Matters
When NVD gives no versions, a scanner relying on CPE bounds will flag nothing, even on an affected device. What's left is your inventory: knowing which version runs on each Nexus and each licensing server, so you can check it against the vendor advisory.
With cveo.tech, register your Cisco devices with exact versions, and get alerted whenever a critical CVE affects them.