Act nowDisclosed

Advisory · CVE-2026-76501

Cisco NX-OS SRv6 plus NGOAM flaw allows unauthenticated root code execution

CVE-2026-76501 affects Nexus switches with both NGOAM and SRv6 enabled, letting an unauthenticated remote attacker execute arbitrary code with root privileges.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco NX-OS Software
Identifier / CWE
CVE-2026-76501
CWE-121
Action timing
Immediate
ELI5

Explain it like I’m five

When a switch runs both a diagnostic feature and a newer routing feature, a stranger can send it a bad packet and the switch hands over the keys to the kingdom.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Both features enabled

    A Nexus 9000 Series switch in standalone NX-OS mode has both NGOAM and SRv6 enabled (Nexus 3000 does not support SRv6).

  2. 02Crafted packets

    An unauthenticated, remote attacker sends crafted packets to an IP interface on the device.

  3. 03Validation fails

    Improper input validation of the IP traffic in the NGOAM/SRv6 OAM path causes a stack-based buffer overflow.

  4. 04Root execution

    The attacker executes arbitrary code with root privileges, or crashes processes causing a reload and denial of service.

What happened

Cisco disclosed CVE-2026-76501 on October 7, 2026, rating it Critical with a CVSS base score of 9.8, alongside CVE-2026-76485 and CVE-2026-76486 in one advisory. The flaw is in the Segment Routing over IPv6 (SRv6) OAM feature, known as NGOAM, of Cisco NX-OS Software. A switch must have both NGOAM and SRv6 enabled to be affected. An unauthenticated, remote attacker can execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an IP interface.

Per the advisory, Cisco Nexus 3000 Series switches do not support SRv6, so exposure is limited to the subset of Cisco Nexus 9000 Series switches that support SRv6 and have both features enabled. Cisco has released software updates that address the vulnerability.

What to do

  1. Check feature status with show feature | include ngoam and show feature | include srv6 at the NX-OS CLI.
  2. If either feature is not required, disabling it removes exposure.
  3. Apply the fixed NX-OS software from the advisory’s fixed-release guidance.
  4. Review logs and reload history for unexplained process crashes.

Management note

The third of three same-day NGOAM RCEs, and the narrowest: it needs both NGOAM and SRv6 on the small subset of Nexus 9000s that support SRv6. Confirm the feature combination before scheduling emergency maintenance; most fleets will have few or no exposed devices.