Switch Update 23.0.0 Fixes a Flaw That Needs Your QR Code

Update an original Switch, Switch Lite or Switch OLED (affiliate link to Amazon, opens in a new tab) to system version 23.0.0. Nintendo released it on 9 September 2026 to fix a flaw that could let someone run code on the console or read information stored on it.

The flaw is narrower than a headline suggests. Nintendo says it only works if someone else scans the QR code your Switch puts on screen during two features: Send to Smartphone in the Album, and Mario Kart Live: Home Circuit.

Switch 2 (affiliate link to Amazon, opens in a new tab) owners have less to do. Nintendo says the flaw cannot be used to obtain console information on Switch 2, and the CVE record lists only the original Switch as affected. Switch 2 got its own version 23.0.0 the same day, and it is worth installing anyway, but its notes do not mention security.

Check your version, then update

You need the console online for the download. Nintendo lists the same path for all three models of the original Switch.

1. From the HOME Menu, open System Settings.
2. Scroll down the left side to System.
3. Read the number under System Update. If it says 23.0.0 or higher, you are done.
4. If it is lower, select System Update. The console checks for the update and starts downloading it on its own.
5. If the update fails, hold the POWER button for three seconds, choose Power Options, then Restart, and try again.

Nintendo says a Switch downloads updates automatically “in most situations” while it is online. It does not say which situations are the exception, so check the number rather than assume.

What the flaw is, in Nintendo’s words

Nintendo filed it as CVE-2026-82079: a stack-based buffer overflow in the Switch’s local wireless networking. Nintendo scores it 7.0, High, under CVSS 4.0. Outside security researchers reported it; the record does not name them.

What an attacker gets. The advisory says they “could run unauthorized code on your Nintendo Switch console or obtain information stored on the console”. That is the whole description. It does not mention your Nintendo Account, a saved payment card or save data, and we are not going to fill that gap with a guess.

What an attacker needs. Physical sight of your screen. Nintendo’s condition is that a third party has to scan the QR code shown on the console or the TV. That is not the same as “only in public”: a visitor in your living room could scan a TV as easily as a stranger on a train could scan a handheld.

If you cannot update yet

Nintendo’s advice until you can:

• Use Send to Smartphone only with your own phone, and only where nobody else can point a camera at the screen.
• Do not use a Mario Kart Live kart that is not yours.
• Everything else on the console is outside the two situations the advisory names.

What else 23.0.0 changes

Nintendo’s notes list two other changes: virtual game card settings, and a prompt about online licences, alongside “general system stability improvements”. Both touch the digital games on the console, which the store terms treat as a licence rather than something you own. If you are weighing what else a console asks of you once it is home, we added that up in what a console costs after you buy it.

That Nintendo was still shipping a security fix to a nine-year-old console is one of the things worth knowing before buying one, which is why we went through everything Nintendo still publishes about the original Switch.