Cisco Nexus Dashboard CVE-2026-76409

Requires a valid low-privileged authenticated session on Cisco Nexus Dashboard (PR:L) and network reachability to the management interface (AV:N); no user interaction is needed. Affected versions span a broad range from 2.1(1d) through 4.2.1 per EUVD. The key limiting factor is authentication - an attacker must already possess or obtain Nexus Dashboard credentials, so this is not exploitable by fully unauthenticated internet attackers. Because the advisory is a grouped hardening release, the exact vulnerable feature, endpoint, or configuration mode is not disclosed; defenders should assume any Nexus Dashboard node exposing its API/UI to accounts of any privilege level is in scope until patched.

This is a genuinely serious vulnerability by CVSS metrics (8.8 High) but with important caveats. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity path traversal requiring only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact. However, exploitation signal is weak: no EPSS score is provided, the CVE is NOT in CISA KEV (no public exploit identified at time of analysis), and no POC is referenced. The advisory (cisco-sa-hardening-ndw1-psFvnrg) is a GROUPED hardening release covering multiple internally-discovered vulnerabilities, so the C:H/I:H/A:H triad is vendor-asserted rather than independently corroborated by a dedicated per-vuln analysis - CVE-2026-76409 specifically covers the CWE-22 path-traversal subset. The PR:L requirement (a valid Nexus Dashboard account) is the primary real-world limiter, meaning this is not a wormable unauthenticated flaw and is more likely relevant to insider/post-foothold escalation than mass internet exploitation. Net: patch as a high priority on internet- or management-plane-exposed Nexus Dashboard nodes, but the absence of KEV/POC/EPSS suggests no widespread active exploitation, so this is elevated-but-not-emergency. Note the same advisory bundles a PR:N unauthenticated critical (CVE-2026-20326) - prioritize the advisory as a whole.

An attacker holding a low-privileged Cisco Nexus Dashboard account (or one who has phished/reused valid credentials) sends a crafted API or file-handling request containing directory-traversal sequences (e.g. ../) to read or write files outside the intended directory. By reading sensitive configuration/credential files or writing to privileged locations, the attacker escalates to full compromise of the Nexus Dashboard node. No POC is publicly available and the flaw is not in CISA KEV, so exploitation would currently require independent development.