Cisco NX-API Carries an Unauthenticated Root RCE, and It Stays Off Until Automation Turns It On

CVE-2026-76471 allows an unauthenticated, remote attacker to send a crafted HTTP request to the NX-API of an affected device to execute arbitrary code with root privileges, provided the feature is enabled. The bug, detailed in the official Cisco advisory published October 7, is a heap buffer overflow (CWE-122) carrying a CVSS base score of 9.8. […]