EUVD-2026-94449
GHSA-8g9j-7mq6-rw6g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach data-plane interface over network
-
DeliverySend high-rate UDP/TCP connection flood
-
ExploitBypass improper protocol rate limiting
-
ExecutionInduce control/routing-plane packet loss
-
ImpactTemporary denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network-level reachability to a data-plane interface of the affected Cisco NX-OS device and the ability to send a sustained high rate of UDP or TCP connections to it; the root cause is that rate limiting was improperly applied to some protocols. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. LIMITING FACTORS: impact is availability-only and temporary - routing/control-plane disruption occurs only while the flood is active and clears automatically once traffic stops, with no persistence, data loss, or code execution. Practical risk is further bounded by whether the targeted data-plane interface is reachable from untrusted networks versus trusted internal segments only. |
| Impact | This is a genuine but comparatively low-urgency issue. The CVSS 5.8 (Medium) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L describes a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) attack with no user interaction, which normally signals easy exploitation. However, every mitigating factor pulls real-world risk down: there is NO confidentiality or integrity impact (C:N/I:N) and only LOW availability impact (A:L), because the description explicitly states the DoS is transient - it 'clears without manual intervention soon after the high rate of traffic is stopped.' The scope change (S:C) reflects that flooding one data-plane interface degrades separate routing/control-plane protocols, which is why this rates above a trivial single-service DoS. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no proof-of-concept was referenced, so exploitation status is: no public exploit identified at time of analysis. Net assessment: a real, prioritizable availability bug for operators of exposed Cisco data-center switches, but not an emergency - there is no code execution, no data exposure, and recovery is automatic once traffic stops. Prioritize patching on internet- or untrusted-network-facing NX-OS interfaces; deprioritize for devices reachable only from trusted internal segments. |
| Exploit ScenarioDerived | An attacker with network reachability to a data-plane interface of an affected Cisco NX-OS device sends a sustained high rate of UDP or TCP connections. Because rate limiting is improperly applied to some protocols, the flood induces packet loss that destabilizes routing and control-plane protocols, producing temporary network disruption. No proof-of-concept was referenced in the input, and the condition self-resolves once the flood ceases. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated remote attackers can temporarily disrupt Cisco NX-OS devices by flooding a data-plane interface with a high rate of UDP or TCP connections, exhausting resources and causing packet loss that destabilizes routing and control-plane protocols. The denial-of-service condition is availability-only and self-clears once the traffic stops, but the CVSS 3.1 score of 5.8 reflects a scope change and low availability impact. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patch: Cisco has published a security advisory with fixed software versions; consult https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7 to identify the exact upgrade path for your platform and version. As a compensating control, restrict access to data-plane interfaces from untrusted networks using ingress ACLs, and deploy control-plane policing (CoPP) to rate-limit UDP and TCP traffic destined to the device. Be aware that overly aggressive ACLs or CoPP policies may drop legitimate traffic; conversely, if the device's own rate limiting is the flawed component, external ACLs are more reliable than relying on device-internal rate limits. Monitoring for high-rate UDP/TCP bursts to data-plane interfaces can provide early warning, and the temporary nature of the DoS means service resumes automatically once the flood stops.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco NX-OS is the network operating system for Cisco Nexus and MDS switches. This vulnerability stems from improper rate limiting applied to certain protocols, classified as CWE-770 (Allocation of Resources Without Limits or Throttling). An attacker can send sustained high-rate UDP or TCP connections to a data-plane interface, exhausting system resources and indirectly impacting control-plane and routing protocols through packet loss. The scope change (S:C) in the CVSS vector indicates that the vulnerable data-plane component affects other components, though confidentiality and integrity are unaffected. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required. The impact is strictly temporary, clearing automatically when the flood ceases.
Know when Cisco Nx Os Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Remote unauthenticated flood (AV:N/AC:L/PR:N/UI:N); scope changed (S:C) as one interface's flood degrades separate control-plane protocols; only transient availability impact (A:L), no C/I.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.
This vulnerability exists because rate limiting was improperly applied to some protocols. An attacker could exploit this vulnerability by sending a high rate of UDP or TCP connections to a data plane interface on an affected device. A successful exploit could allow the attacker to cause instability to various routing and control plane protocols through some packet loss and temporary disruptions, causing a DoS condition. This DoS condition will clear without manual intervention soon after the high rate of traffic is stopped.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Cisco Nx Os Software
View allUnauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execu
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 feat
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthentic
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Un
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified C
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in A
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote,
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affecte
Exploit-DB