# NX-OS vulnerabilities > NX-OS is made by Cisco. We track 275 published vulnerabilities listed under that exact name, across 1,098 versions. 2 of them are on the list of flaws known to be exploited, the newest added on 2 July 2024. Cisco lists newer releases under their own names, such as NX-OS for Nexus 5500 Platform Switches, so check those pages too. Canonical page: https://www.precursorintelligence.com/product/cisco/nx-os ## At a glance - **Made by:** [Cisco](https://www.precursorintelligence.com/vendors/cisco) - **Published vulnerabilities:** 275 - **Known to be exploited:** 2 (listed under the name NX-OS) - **Versions tracked:** 1,098 - **Most recently added to the known-exploited list:** [CVE-2024-20399](https://www.precursorintelligence.com/what-is/cve-2024-20399), 2 July 2024. We keep watching the list. ## Is NX-OS listed under other names? Cisco also lists NX-OS under more specific names, such as NX-OS for Nexus 5500 Platform Switches and NX-OS for Nexus 5600 Platform Switches. Flaws listed only under those names are counted on their own pages, not here. - [NX-OS for Nexus 5500 Platform Switches](https://www.precursorintelligence.com/product/cisco/nx-os_for_nexus_5500_platform_switches): 2 published vulnerabilities - [NX-OS for Nexus 5600 Platform Switches](https://www.precursorintelligence.com/product/cisco/nx-os_for_nexus_5600_platform_switches): 2 published vulnerabilities - [NX-OS for Nexus 7700 Series Switches](https://www.precursorintelligence.com/product/cisco/nx-os_for_nexus_7700_series_switches): 2 published vulnerabilities ## Which versions of NX-OS do the exploited flaws hit? Each exploited flaw lists the versions it affects, as published. "before 10.2(7)" means every version up to, but not including, 10.2(7). - [CVE-2024-20399](https://www.precursorintelligence.com/what-is/cve-2024-20399) (Cisco NX-OS Command Injection Vulnerability): 6.0(2)a6(1a), 6.0(2)a6(1), 6.0(2)a6(2a), 6.0(2)a6(2), 6.0(2)a6(3a), 6.0(2)a6(3), 6.0(2)a6(4a), 6.0(2)a6(4), 6.0(2)a6(5a), 6.0(2)a6(5b), 6.0(2)a6(5), 6.0(2)a6(6), 6.0(2)a6(7), 6.0(2)a6(8), 6.0(2)a8(1), 6.0(2)a8(10a), 6.0(2)a8(10), 6.0(2)a8(11a), 6.0(2)a8(11b), 6.0(2)a8(11), 6.0(2)a8(2), 6.0(2)a8(3), 6.0(2)a8(4a), 6.0(2)a8(4), 6.0(2)a8(5), 6.0(2)a8(6), 6.0(2)a8(7a), 6.0(2)a8(7b), 6.0(2)a8(7), 6.0(2)a8(8), 6.0(2)a8(9), 6.0(2)u6(1a), 6.0(2)u6(1), 6.0(2)u6(10), 6.0(2)u6(2a), 6.0(2)u6(2), 6.0(2)u6(3a), 6.0(2)u6(3), 6.0(2)u6(4a), 6.0(2)u6(4), 6.0(2)u6(5a), 6.0(2)u6(5b), 6.0(2)u6(5c), 6.0(2)u6(5), 6.0(2)u6(6), 6.0(2)u6(7), 6.0(2)u6(8), 6.0(2)u6(9), 6.2(1), 6.2(10), 6.2(11b), 6.2(11c), 6.2(11d), 6.2(11e), 6.2(11), 6.2(12), 6.2(13a), 6.2(13b), 6.2(13), 6.2(14), 6.2(15), 6.2(16), 6.2(17), 6.2(18), 6.2(19), 6.2(2a), 6.2(2), 6.2(20a), 6.2(20), 6.2(21), 6.2(22), 6.2(23), 6.2(24a), 6.2(24), 6.2(25), 6.2(27), 6.2(29), 6.2(3), 6.2(31), 6.2(33), 6.2(5a), 6.2(5b), 6.2(5), 6.2(6a), 6.2(6b), 6.2(6), 6.2(7), 6.2(8a), 6.2(8b), 6.2(8), 6.2(9a), 6.2(9b), 6.2(9c), 6.2(9), 7.0(3)f1(1), 7.0(3)f2(1), 7.0(3)f2(2), 7.0(3)f3(1), 7.0(3)f3(2), 7.0(3)f3(3a), 7.0(3)f3(3c), 7.0(3)f3(3), 7.0(3)f3(4), 7.0(3)f3(5), 7.0(3)i4(1), 7.0(3)i4(2), 7.0(3)i4(3), 7.0(3)i4(4), 7.0(3)i4(5), 7.0(3)i4(6), 7.0(3)i4(7), 7.0(3)i4(8a), 7.0(3)i4(8b), 7.0(3)i4(8z), 7.0(3)i4(8), 7.0(3)i4(9), 7.0(3)i5(1), 7.0(3)i5(2), 7.0(3)i6(1), 7.0(3)i6(2), 7.0(3)i7(1), 7.0(3)i7(10), 7.0(3)i7(2), 7.0(3)i7(3), 7.0(3)i7(4), 7.0(3)i7(5a), 7.0(3)i7(5), 7.0(3)i7(6), 7.0(3)i7(7), 7.0(3)i7(8), 7.0(3)i7(9), 7.1(0)n1(1a), 7.1(0)n1(1b), 7.1(0)n1(1), 7.1(1)n1(1), 7.1(2)n1(1), 7.1(3)n1(1), 7.1(3)n1(2), 7.1(4)n1(1), 7.1(5)n1(1b), 7.1(5)n1(1), 7.2(0)d1(1), 7.2(1)d1(1), 7.2(2)d1(1), 7.2(2)d1(2), 7.3(0)d1(1), 7.3(0)dx(1), 7.3(0)dy(1), 7.3(0)n1(1), 7.3(1)d1(1), 7.3(1)dy(1), 7.3(1)n1(1), 7.3(10)n1(1), 7.3(11)n1(1), 7.3(12)n1(1), 7.3(13)n1(1), 7.3(14)n1(1), 7.3(2)d1(1), 7.3(2)d1(2), 7.3(2)d1(3a), 7.3(2)d1(3), 7.3(2)n1(1), 7.3(3)d1(1), 7.3(3)n1(1), 7.3(4)d1(1), 7.3(4)n1(1), 7.3(5)d1(1), 7.3(5)n1(1), 7.3(6)d1(1), 7.3(6)n1(1), 7.3(7)d1(1), 7.3(7)n1(1a), 7.3(7)n1(1b), 7.3(7)n1(1), 7.3(8)d1(1), 7.3(8)n1(1), 7.3(9)d1(1), 7.3(9)n1(1), 8.0(1), 8.1(1a), 8.1(1b), 8.1(1), 8.1(2a), 8.1(2), 8.2(1), 8.2(10), 8.2(11), 8.2(2), 8.2(3), 8.2(4), 8.2(5), 8.2(6), 8.2(7a), 8.2(7), 8.2(8), 8.2(9), 8.3(1), 8.3(2), 8.4(1a), 8.4(1), 8.4(2a), 8.4(2b), 8.4(2c), 8.4(2d), 8.4(2e), 8.4(2f), 8.4(2), 8.4(3), 8.4(4a), 8.4(4), 8.4(5), 8.4(6a), 8.4(6), 8.4(7), 8.4(8), 8.4(9), 8.5(1), 9.2(1a), 9.2(1), 9.2(2t), 9.2(2v), 9.2(2), 9.2(3), 9.2(4), 9.3(1), 9.3(10), 9.3(11), 9.3(12), 9.3(13), 9.3(2a), 9.3(2), 9.3(3), 9.3(4), 9.3(5), 9.3(6), 9.3(7a), 9.3(7), 9.3(8), 9.3(9), 9.4(1a), 9.4(1), 9.4(2), 10.1(1), 10.1(2), 10.2(1q), 10.2(1), 10.2(2), 10.2(3), 10.2(4), 10.2(5), 10.2(6), 10.2(7), 10.2(8), 10.3(1), 10.3(2), 10.3(3), 10.3(4a), 10.3(5), 10.3(99w), 10.3(99x), 10.4(1), 10.4(2) - [CVE-2023-44487](https://www.precursorintelligence.com/what-is/cve-2023-44487) (HTTP/2 Rapid Reset Attack Vulnerability): before 10.2(7), 10.3(1) to before 10.3(5), 10.4(1) to before 10.4(2) ## Which NX-OS vulnerabilities are being exploited? 2 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2024-20399](https://www.precursorintelligence.com/what-is/cve-2024-20399): Cisco NX-OS Command Injection Vulnerability. Medium, CVSS 6.0, chance of use in 30 days 4.3%, known exploited since 2 July 2024. - [CVE-2023-44487](https://www.precursorintelligence.com/what-is/cve-2023-44487): HTTP/2 Rapid Reset Attack Vulnerability. High, CVSS 7.5, chance of use in 30 days >99%, known exploited since 10 October 2023. ## Which NX-OS flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2023-44487](https://www.precursorintelligence.com/what-is/cve-2023-44487): >99%, High (CVSS 7.5), known exploited - [CVE-2020-10136](https://www.precursorintelligence.com/what-is/cve-2020-10136): 29%, Medium (CVSS 5.3) - [CVE-2018-0301](https://www.precursorintelligence.com/what-is/cve-2018-0301): 17%, Critical (CVSS 9.8) - [CVE-2022-20650](https://www.precursorintelligence.com/what-is/cve-2022-20650): 15%, High (CVSS 8.8) - [CVE-2019-1599](https://www.precursorintelligence.com/what-is/cve-2019-1599): 14%, High (CVSS 8.6) - [CVE-2022-20624](https://www.precursorintelligence.com/what-is/cve-2022-20624): 12%, High (CVSS 7.5) - [CVE-2022-20623](https://www.precursorintelligence.com/what-is/cve-2022-20623): 12%, High (CVSS 7.5) - [CVE-2016-1453](https://www.precursorintelligence.com/what-is/cve-2016-1453): 8.1%, Critical (CVSS 9.8) - [CVE-2020-3119](https://www.precursorintelligence.com/what-is/cve-2020-3119): 4.8%, High (CVSS 8.8) - [CVE-2018-0293](https://www.precursorintelligence.com/what-is/cve-2018-0293): 4.8%, High (CVSS 8.8) ## Questions ### How many vulnerabilities does NX-OS have? We track 275 published vulnerabilities listed under the name NX-OS, across 1,098 versions. The most recent NX-OS flaw added to the known-exploited list is CVE-2024-20399, on 2 July 2024. ### Which NX-OS vulnerabilities are being exploited? 2 are on the list of flaws known to be exploited. The most recently added are CVE-2024-20399 and CVE-2023-44487. ### Why are newer NX-OS flaws missing from this page? Cisco also lists NX-OS under more specific names, such as NX-OS for Nexus 5500 Platform Switches and NX-OS for Nexus 5600 Platform Switches. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list. ### Which versions of NX-OS do the exploited flaws affect? Each flaw names its own versions, usually as ranges. The newest, CVE-2024-20399, affects 6.0(2)a6(1a), 6.0(2)a6(1), 6.0(2)a6(2a), 6.0(2)a6(2) and more. The versions for every exploited flaw are listed on this page. ### How do I get alerts for NX-OS? Create a Precursor Intelligence account and track NX-OS. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook. ## Running NX-OS? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact