Checking Cisco NX-OS Advisories for Your Release

Working out which vulnerabilities apply to NX-OS 9.3(13), or how far your own release has been fixed, is slow and error-prone if you do it by searching CVE numbers one at a time. Cisco provides an official tool that takes a release and returns the applicable advisories and the fixing release. This article covers everything from identifying the running release to interpreting the results, verified against primary sources on 4 August 2026.

The answer: use the Software Checker for release-specific exposure

Questions such as "which CVEs apply to NX-OS 9.3(13)" or "which patches does 9.3(1) need" are answered officially by the Cisco Software Checker. At the time of checking, the URLs were:

• Cisco Software Checker: https://sec.cloudapps.cisco.com/security/center/softwarechecker.x
• Cisco Security Advisories (published advisory listing): https://sec.cloudapps.cisco.com/security/center/publicationListing.x

The Software Checker page states its coverage as follows.

Use the Cisco Software Checker to search for Cisco Security Advisories that apply to specific software releases of the following products: Cisco ASA, FMC, FTD, FXOS, IOS, IOS XE, NX-OS and NX-OS in ACI Mode.

Cisco's own advisories point to the same tool as the standard way to determine exposure.

To help customers determine their exposure to vulnerabilities in Cisco NX-OS Software, Cisco provides the Cisco Software Checker. This tool identifies any Cisco security advisories that impact a specific software release and the earliest release that fixes the vulnerabilities that are described in each advisory ("First Fixed"). If applicable, the tool also returns the earliest release that fixes all the vulnerabilities described in all the advisories that the Software Checker identifies ("Combined First Fixed").

Two result fields matter here: First Fixed and Combined First Fixed. The first is the earliest release that fixes a given advisory; the second is the earliest release that fixes all of the advisories found. Use Combined First Fixed when choosing an upgrade target. Picking a release from an individual First Fixed leaves the other advisories unfixed.

Two limitations to know before you read the results

The Software Checker page carries two caveats you cannot ignore when interpreting its output.

This tool does not provide information about Cisco IOS XR Software or interim software builds. Also note that for Cisco ASA, FMC, FTD and FXOS Software, the tool only contains vulnerability information for Cisco Security Advisories first published from January, 2022 onward, and for NX-OS Software and NX-OS Software in ACI Mode from July, 2019 onward.

This tool is intended solely to query certain Cisco software releases against published Cisco Security Advisories; it does not account for enabled or disabled features.

• For NX-OS, only advisories first published from July 2019 onward are included. Anything older will not surface here. When assessing an older release, cross-check the published advisory listing as well.
• Enabled and disabled features are not taken into account. A hit does not automatically mean you are exploitable. You still have to read each advisory's Vulnerable Products and indicators sections and compare the stated preconditions against your own configuration.

Step 1: establish your exact release

The Software Checker takes a release number, so start by determining what is running. The Cisco Nexus 9000 Series NX-OS Command Reference (Show Commands), Release 10.4(x), documents show version as "Show the software version", in command mode /exec.

switch# show version

Which field of the output carries the release string depends on the platform. Here are the output samples from Cisco's own guides.

Nexus 9000 (single NXOS image)

switch# show version
...
Software
  BIOS: version 08.26
  NXOS: version 7.0(3)I7(1)
  BIOS compile time:  06/12/2016
  NXOS image file is: bootflash:///nxos.7.0.3.I7.1.b

The NXOS: version field in the Software block is what you enter into the Software Checker.

Nexus 7000 (separate kickstart and system images)

switch# show version
...
Software
  BIOS:      version 3.1.0
  kickstart: version 8.0(1)
  system:    version 8.0(1)

In this format the relevant field is system: version, which normally matches kickstart: version.

Step 2: feed it into the Software Checker

The page offers three input methods.

• A. Search By Release - pick a Cisco operating system and specify the release
• B. Use Show Version Command Output - paste the output of show version directly
• C. Upload a .txt file from your local system - upload a file listing the releases

Option C is efficient for a large estate. For a single device, or when you are unsure which field to read, option B is the safer choice.

The usage steps published in Cisco's advisories are:

1. Choose which advisories the tool will search-only this advisory, only advisories with a Critical or High Security Impact Rating (SIR), or all advisories.
2. Choose the appropriate software.
3. Choose the appropriate platform.
4. Enter a release number-for example, 10.4(4) for Cisco Nexus 3000 Series Switches or 16.0(8e) for Cisco NX-OS Software in ACI mode.
5. Click Check.

Pay attention to the first choice. Because the tool can also be pointed at a single advisory, an inventory exercise needs "all advisories". Narrowing to Critical and High alone will miss everything rated Medium or below.

Software and platform options

The same search form embedded in Cisco's advisories exposes these options.

NX-OS coverage extends beyond the Nexus line to the MDS 9000 storage networking switches. ACI mode is selected as a separate software product.

Get the release-number format right

NX-OS releases take the form major.minor(maintenance), sometimes with a trailing letter. Cisco's own examples are 10.4(4) for Nexus 3000 NX-OS and 16.0(8e) for ACI mode. 9.3(13) and 9.3(1) follow the same pattern.

Older Nexus 9000 releases used an extended form such as 7.0(3)I7(1), as in the show version sample above. The safest approach is to enter exactly the string shown in the output, without abbreviating it or dropping the parentheses.

That page also links to an End-of-Sale / End-of-Life announcement covering the Nexus 3000 / 9000 9.3(x) train. If you run 9.3, lifecycle status needs checking alongside vulnerability exposure. The specific dates are out of scope for this article; read the announcement page itself.

Step 3: turn the results into operational work

1. Target the Combined First Fixed release, not an individual First Fixed.
2. Check the target against the recommended releases, since your hardware may not support it.
3. Read each advisory's preconditions. Because the tool ignores enabled and disabled features, narrow the hits down to the ones that actually hold in your configuration.
4. Cover advisories published before July 2019 separately. The longer an environment has stayed on an old release, the more this gap matters.
5. Make it repeatable. Alongside the advisory listing, Cisco points to the CVRF repository, the Cisco PSIRT openVuln API, the Cisco Vulnerability Repository and Bug Search. In a large estate there is room to automate this through the API.

If you are the one reporting a vulnerability

Cisco's Security Vulnerability Policy names psirt@cisco.com as the reporting channel and calls it "This is the most effective method". The same policy states that PSIRT aligns its practices with ISO/IEC 29147:2018. The policy describes its own purpose as follows.

This policy was created to guide and inform Cisco customers in the event of a reported vulnerability in a Cisco product or cloud-hosted service. It ensures that Cisco customers have a consistent, unambiguous resource to help them understand how Cisco responds to events of this nature.