CVE-2026-76465: Unauthenticated RCE in Cisco NX-OS MPLS OAM (Nexus 3000/9000) · ZeroHour

CVE-2026-76465

large

Unauthenticated RCE in Cisco NX-OS MPLS OAM (Nexus 3000/9000)

CVSS 3.1

9.8 critical

EPSS

—

Published

Oct 7, 2026 (1d ago)

Modified

Oct 8, 2026

AI analysis

CVE-2026-76465 is a critical flaw in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS on Nexus 3000 Series and Nexus 9000 Series switches. It is caused by improper validation of MPLS echo-request packets (CWE-590). An unauthenticated remote attacker who sends a crafted MPLS echo-request to an IP address on an affected device can run arbitrary code as root or crash a process, which can reload the switch and cause a denial of service. Only switches running the vulnerable NX-OS MPLS OAM feature are affected; exact version ranges were not included in the source data. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply the Cisco NX-OS fix for CVE-2026-76465 as soon as it is available for your Nexus 3000 or 9000 release, and until then disable MPLS OAM if it is not required. Restrict which hosts can send MPLS echo-requests to switch IP addresses and watch for unexpected process crashes or device reloads.

Affected

Cisco NX-OS Software for Nexus 3000 Series Switches	—
Cisco NX-OS Software for Nexus 9000 Series Switches	—

Estimated exposure

largeOn the order of 10,000–100,000 Nexus 3000/9000 switches with MPLS OAM (internet-exposed subset unknown) — Estimate only: Nexus 3000 and 9000 are widely deployed data-center switches, so the installed base is plausibly in the tens to low hundreds of thousands, but the flaw applies only where MPLS OAM processes echo-requests and no public scan…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.

Weakness: CWE-590
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (—)

CVE-2026-76465

In the news2 stories

Cisco warns of critical flaws allowing Nexus switch takeover

Cisco Patches a Dozen Critical Vulnerabilities