Cisco NX-OS Has Six Unauthenticated RCE CVEs Across Four Functional Planes in One Disclosure Cycle

Analysis

Forwarding, management, diagnostic, and monitoring planes all carry CVSS 9.8 root-access flaws — a pattern that suggests architectural security debt, not isolated bugs.

The Four-Plane Vulnerability Pattern in Cisco NX-OS

The October 2026 Cisco NX-OS semiannual bundle exposes a systemic vulnerability pattern: six critical flaws distributed across four distinct functional planes. Each vulnerability carries a CVSS 9.8 rating and enables unauthenticated remote root code execution on Nexus 3000 and 9000 series switches.

This disclosure highlights the limitations of a trust-through-defaults security model. While Cisco maintains that features like NX-API, MPLS OAM, and NGOAM are disabled by default, enterprise data center requirements for operational visibility frequently necessitate their activation. This operational reality renders the default-disabled posture ineffective as a primary defense mechanism.

Forwarding Plane: The S1HAL Exposure

The forwarding plane vulnerability,