On paper, the beginning of October appeared relatively quiet, but when Cisco published its autumn bulletin batch for Nexus switches and NX-OS software on Wednesday, carrier networks and data centers felt the heat. Three independent remote code execution flaws carrying a 9.8 severity score were disclosed, all allowing unauthenticated root execution. Additionally, SonicWall issued a patch for a CVSS 10.0 vulnerability in SMA1000 gateways that saw active in-the-wild exploitation by the end of the week.
1. Cisco NX-OS & Nexus Switches: Triple Unauthenticated Root RCE (CVE-2026-76471, CVE-2026-76465, CVE-2026-76485, CVSS 9.8)
Cisco PSIRT published a substantial bulletin batch covering NX-OS software and Nexus 3000/9000 switches. Among them were three distinct critical flaws, each rated 9.8 under CVSS 3.1. All three permit a remote, unauthenticated attacker to execute code with root privileges or trigger device crashes and reboots.
The first flaw (CVE-2026-76471) resides in the NX-API programming interface due to insufficient input validation in HTTP requests. If NX-API is enabled, a crafted network request allows complete takeover. Affected systems span NX-OS releases 9.2 through 10.6, including Cisco UCS Fabric Interconnects.
The second flaw (CVE-2026-76465) involves MPLS echo-request packet handling within the OAM (Operation, Administration, and Maintenance) module on Nexus 3000 and 9000 switches. A single crafted packet sent to an IP interface triggers buffer validation failure and root code execution.
The third flaw (CVE-2026-76485, alongside CVE-2026-76486 and CVE-2026-76501) affects the newer NGOAM (Next Generation OAM / VXLAN OAM) module. Crafted IP traffic directed at interfaces with NGOAM enabled leads to buffer overflow and root execution.
- Identifiers: CVE-2026-76471, CVE-2026-76465, CVE-2026-76485
- Base Score: CVSS 9.8 (Critical)
- Affected Systems: Cisco Nexus 3000/9000 switches and UCS Fabric Interconnects running NX-OS
- Mitigation: Install Cisco NX-OS updates, restrict network access to NX-API endpoints
- Source: Cisco PSIRT Advisories
2. SonicWall SMA1000: CVSS 10.0 Flaw and Active In-The-Wild Exploitation (CVE-2026-102255)
On Wednesday, SonicWall released urgent patches for SMA1000 secure remote access gateways (models 6200, 6210, 7200, 7210, and virtual 8000v). Vulnerability CVE-2026-102255 received the maximum possible score: CVSS 10.0. It represents a Server-Side Request Forgery (CWE-441, CWE-918) defect within the Work Place login interface resulting from an unintended alternate access path.
An unauthenticated external user can leverage the gateway to generate requests targeting internal infrastructure resources or directly invoke protected administrative functions. Security researchers and intelligence feeds confirmed active scanning and compromise attempts against unpatched gateways by Friday, October 9. Fixed builds include 12.4.3-03526 and 12.5.0-02952 (platform hotfixes).
- Identifier: CVE-2026-102255
- Base Score: CVSS 10.0 (Critical)
- Exploitation Status: Active scanning and in-the-wild exploitation observed
- Affected Systems: SonicWall SMA1000 series appliances
- Mitigation: Install SonicWall platform hotfix immediately
- Source: SonicWall Security Advisory SNWLID-2026-0017
3. Atlassian Data Center: Arbitrary File Access with Public PoC (CVE-2026-21589, CVSS 9.3)
Atlassian published a security bulletin addressing a critical flaw across Data Center products: Confluence, Jira Software, Jira Service Management, Bitbucket, Bamboo, and Crowd. Vulnerability CVE-2026-21589 carries a CVSS 4.0 rating of 9.3.
The defect is an Arbitrary File Access (CWE-552) vulnerability enabling unauthenticated remote users to read arbitrary files from the web application root directory. A specialized path traversal construct using colon sequences (..::..::..::/) bypasses path validation checks. Knowledge of default configuration filenames allows attackers to retrieve database credentials and session secrets, leading to full administrative takeover. watchTowr Labs released a detailed technical analysis accompanied by a working proof-of-concept (PoC).
- Identifier: CVE-2026-21589
- Base Score: CVSS 9.3 (Critical)
- Exploitation Status: Public PoC available, high automated scanning risk
- Affected Systems: Atlassian Data Center product suites
- Mitigation: Upgrade Confluence to 9.2.26 / 10.2.19, Jira to 9.12.40 / 10.3.26, and corresponding product releases
- Source: Atlassian Security Advisory
4. WordPress Core: Release 7.1.3 with Seven Security Fixes
WordPress released version 7.1.3 containing seven core security patches and four bug fixes. This marks the third maintenance update for the 7.1 branch in under a month, following high-profile patches 7.1.1 and 7.1.2. Patched items include a stored XSS in comment moderation, a Denial of Service (DoS) in WP_Http::make_absolute_url(), second-order SQL injection in WXR export, and an authorization defect allowing Authors to sticky posts.
- Releases: WordPress Core 7.1.3
- Source: WordPress News
5. ASUS Routers: Active Debug Code and Remote Root (CVE-2026-13313, CVE-2026-14157, CVSS 8.9)
ASUS published security advisories for SOHO and consumer routers describing flaws allowing arbitrary code execution with root privileges. Vulnerability CVE-2026-13313 stems from an active debug mechanism left enabled in production firmware production builds (CWE-489). An authenticated user sending crafted HTTP requests can bypass security controls, force Telnet daemon activation, and gain a root shell.
- Identifiers: CVE-2026-13313, CVE-2026-14157
- Base Score: CVSS 8.9 (High)
- Affected Systems: ASUS routers running firmware 3.0.0.4 / 3.0.0.6
- Mitigation: Upgrade firmware, disable WAN administration access
- Source: ASUS Security Advisory
Action Items for Today
- Patch Cisco Nexus Switches: Deploy updated NX-OS builds and restrict external access to NX-API ports.
- Remediate SonicWall SMA1000 Gateways: Install the emergency platform hotfix to neutralize the CVSS 10.0 vulnerability.
- Upgrade Atlassian Data Center: Apply patches across Confluence, Jira, and Bitbucket ahead of automated scanner exploitation.
- Verify WordPress Installations: Confirm instances updated successfully to WordPress 7.1.3.
- Update ASUS Routers: Install current firmware and ensure WAN remote management is disabled.
