Act nowDisclosed

Advisory · CVE-2026-76486

Second Cisco NX-OS NGOAM flaw gives unauthenticated attackers root on Nexus switches

CVE-2026-76486 affects Nexus 3000/9000 switches with NGOAM plus SRv6 or NV Overlay enabled, allowing unauthenticated remote code execution with root privileges.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76486
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

Same broken diagnostic feature as its sibling flaw, but this one only answers when two extra network features are also switched on. Then a stranger's packet can take over the whole switch.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Features enabled

    A Nexus 3000 or 9000 switch in standalone NX-OS mode has NGOAM enabled along with SRv6 or NV Overlay (with a VXLAN EVPN VNI mapped and a peer VTEP learned).

  2. 02Crafted packets

    An unauthenticated, remote attacker sends crafted packets to an IP interface on the device.

  3. 03Validation fails

    Improper input validation of the IP traffic in the NGOAM feature causes a stack-based buffer overflow.

  4. 04Root execution

    The attacker executes arbitrary code with root privileges, or crashes processes causing a reload and denial of service.

What happened

Cisco disclosed CVE-2026-76486 on October 7, 2026, rating it Critical with a CVSS base score of 9.8, in the same advisory as CVE-2026-76485 and CVE-2026-76501. The flaw is in the NGOAM (VXLAN OAM) feature of Cisco NX-OS Software. For this CVE, the switch must have NGOAM enabled plus either Segment Routing over IPv6 (SRv6) or Network Virtualization (NV) Overlay enabled; NV Overlay additionally requires a VXLAN EVPN VNI mapped to an NVE interface with at least one peer VTEP learned. An unauthenticated, remote attacker can then execute arbitrary code with root privileges or cause a denial of service via crafted packets.

Affected devices are Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode meeting those conditions. Cisco has released software updates that address the vulnerability.

What to do

  1. Check feature status with show feature | include ngoam, show feature | include nve, and show nve vni / show nve peers at the NX-OS CLI.
  2. If NGOAM is not operationally required, disabling it removes exposure to all three NGOAM CVEs in this advisory.
  3. Apply the fixed NX-OS software from the advisory’s fixed-release guidance.
  4. Review logs and reload history for unexplained process crashes.

Management note

This is one of three same-day NGOAM RCEs; they share a fix but differ in the feature combinations that expose them. The triage is configuration-driven: inventory which switches actually run NGOAM with SRv6 or NV Overlay before assuming the whole fleet is at risk.