Act nowDisclosed

Advisory · CVE-2026-76485

Cisco NX-OS NGOAM flaw allows unauthenticated remote code execution as root

Improper input validation in the NGOAM feature of Cisco NX-OS Software lets an unauthenticated remote attacker execute arbitrary code with root privileges on Nexus 3000 and 9000 switches.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76485
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

A diagnostic feature on Cisco's big network switches does not check the mail it receives. A stranger can send a booby-trapped packet and the switch runs it as the boss.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01NGOAM enabled

    A Cisco Nexus 3000 or 9000 Series switch in standalone NX-OS mode has the NGOAM (VXLAN OAM) feature enabled.

  2. 02Crafted packets

    An unauthenticated, remote attacker sends crafted packets to an IP interface on the affected device.

  3. 03Validation fails

    Improper input validation of the IP traffic in the NGOAM feature leads to a stack-based buffer overflow.

  4. 04Root execution

    The attacker executes arbitrary code with root privileges, or crashes processes causing a reload and denial of service.

What happened

Cisco disclosed CVE-2026-76485 on October 7, 2026, rating it Critical with a CVSS base score of 9.8. The flaw is in the VXLAN Operation, Administration, and Maintenance (OAM) feature, known as NGOAM, of Cisco NX-OS Software. Improper input validation of IP traffic when NGOAM is enabled allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an IP interface.

The advisory states the affected devices are Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode with NGOAM enabled. For this CVE, NGOAM being enabled is the only requirement. Cisco has released software updates that address the vulnerability.

What to do

  1. Check whether NGOAM is enabled on your Nexus switches: run show feature | include ngoam at the NX-OS CLI.
  2. If NGOAM is not needed, disabling the feature removes exposure to this CVE.
  3. Apply the fixed NX-OS software from the advisory’s fixed-release guidance.
  4. Restrict which sources can send traffic to switch management and data interfaces where possible.
  5. Review device logs and crash/reload history for unexplained process crashes that could indicate probing.

Management note

Unauthenticated root RCE on data-center switching fabric is about as bad as network vulnerabilities get. The saving grace is a configuration gate: only switches with NGOAM enabled are exposed. Check the feature status first; that triage takes minutes and immediately shrinks the at-risk population.