Cisco flags five critical NX‑OS bugs that could let attackers seize Nexus switches

Cisco Systems has issued security advisories covering five critical flaws discovered in the NX‑OS operating system that powers its Nexus line of data‑center switches. The vulnerabilities, rated as critical by the vendor, allow an unauthenticated attacker to execute arbitrary code with full root privileges on affected devices. Cisco’s notice, first reported by BleepingComputer, stresses that successful exploitation could give an intruder complete control over a switch’s data‑plane and management functions.

NX‑OS is the software foundation for Cisco’s Nexus series, which many enterprises and cloud providers rely on to interconnect servers, storage arrays and other networking equipment in high‑performance environments. Because these switches operate at the core of a data‑center fabric, any breach that escalates to root level can disrupt traffic, bypass segmentation policies, and open pathways to downstream systems. The criticality rating reflects the potential for widespread operational impact across multiple sectors.

According to the advisory, the flaws reside in several components that handle network traffic and device management, such as the SNMP daemon, the web‑based GUI, and certain CLI parsers. An attacker who can reach the vulnerable service—whether from a compromised host on the same VLAN or via a remote foothold—could inject malicious payloads that run directly on the switch’s Linux kernel. In practice, this could enable the hijacking of routing tables, insertion of rogue traffic, or even the deployment of ransomware‑style payloads against connected servers.

Cisco has already published software updates that remediate all five issues and urges customers to apply the patches as soon as possible. The company also recommends enabling feature‑level authentication, restricting management access to trusted networks, and monitoring for unusual process activity on the switches. For environments where immediate patching is not feasible, Cisco suggests employing temporary work‑arounds such as disabling the affected services until a fix can be installed.

The disclosures underscore the ongoing challenge of maintaining security in complex, software‑defined networking gear. Analysts note that the rapid release of fixes demonstrates Cisco’s commitment to addressing high‑severity bugs, but they also remind operators that timely patch management remains essential. As enterprises continue to expand their data‑center footprints, vigilance in updating firmware and hardening switch configurations will be key to preventing adversaries from leveraging similar vulnerabilities in the future.