SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76459

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under the Common Weakness Enumeration (CWE) CWE-787.

Erkennung & Indikatoren

Ausnutzung

Cisco is not aware of any of these vulnerabilities being exploited in the wild.

Behobene Versionen

  • NX-OS Software versions 10.3(10)
  • NX-OS Software versions 10.4(8)

Threat-Hunting-Queries

This vulnerability is an out-of-bounds write issue (CWE-787) in Cisco NX-OS Software. Detection should focus on anomalous process behavior, crashes, or unexpected system reboots on affected Cisco NX-OS devices. Specific IOCs are not available, so behavioral detection is necessary.

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName contains "nxos"
| where ProcessCommandLine contains "out-of-bounds" or ProcessCommandLine contains "memory corruption"
| where ActionType == "ProcessCreated" or ActionType == "ProcessCrashed"
| extend Threat = "CVE-2026-76459 - NX-OS Out-of-Bounds Write"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, Threat

Splunk SPL

index=cisco_nxos sourcetype=syslog (out-of-bounds OR "memory corruption" OR crash) | table _time, host, process, message | rename host as DeviceName, process as InitiatingProcessFileName, message as ProcessCommandLine | eval Threat = "CVE-2026-76459 - NX-OS Out-of-Bounds Write"

Sigma

title: Cisco NX-OS Out-of-Bounds Write
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential exploitation attempts or symptoms of CVE-2026-76459 in Cisco NX-OS.
author: SecBoard
date: 2026/10/08
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR
logsource:
  product: cisco
  service: nxos
detection:
  selection:
    message|contains:
      - 'out-of-bounds'
      - 'memory corruption'
      - 'crash'
  condition: selection
fields:
  - host
  - message
tags:
  - attack.initial_access
  - cve.2026.76459
  - cwe.787
level: high

Elastic ES|QL

from cisco_nxos_logs
| where message : "out-of-bounds" or message : "memory corruption" or message : "crash"
| project @timestamp, host.name, process.name, message
| set threat.name = "CVE-2026-76459 - NX-OS Out-of-Bounds Write"

SecBoard-generated behavioral requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen