Critical Cisco Nexus Switch Vulnerabilities Allow Unauthenticated Attackers to Execute Code as Root

Cisco has disclosed three critical vulnerabilities in its Nexus 3000 and 9000 Series switches that could allow unauthenticated remote attackers to execute arbitrary code with root privileges.

Successful exploitation could crash processes, trigger device reloads, and cause denial of service, disrupting network availability.

Published on October 7, 2026, advisory cisco-sa-ngoam-rce-LWKQ4BU identifies three vulnerabilities: CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501.

Cisco has assigned these vulnerabilities a CVSS base score of 9.8 and lists CWE-121, which classifies them as stack-based buffer overflows.

The flaws affect the Next Generation Operation, Administration, and Maintenance feature, commonly known as NGOAM, in Cisco NX-OS Software. Cisco discovered these vulnerabilities during internal security testing and has released software updates to address them.

Cisco Nexus Switch Vulnerabilities

According to Cisco, these vulnerabilities arise from improper input validation of IP traffic when NGOAM is enabled. An attacker could exploit an affected switch by sending specially crafted packets to an IP interface.

Successful exploitation could lead to root-level code execution or cause process crashes that result in a device reload. The published CVSS vector indicates that exploitation can occur over the network with low attack complexity, requiring no privileges or user interaction.

NGOAM supports network diagnostics and troubleshooting. Its VXLAN functionality provides loop detection and mitigation, while SRv6 NGOAM uses IPv6 ping and path trace mechanisms to verify connectivity and isolate forwarding problems.

The vulnerabilities affect Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode, but their configuration requirements differ:

• CVE-2026-76485: Requires only NGOAM to be enabled.
• CVE-2026-76486: Requires NGOAM plus either Segment Routing over IPv6 or NV Overlay. The overlay configuration must include a VXLAN EVPN VNI mapped to an NVE interface with at least one learned peer VTEP.
• CVE-2026-76501: Requires both NGOAM and SRv6 to be enabled.

Cisco notes that Nexus 3000 switches do not support SRv6, and only a subset of Nexus 9000 switches supports it. Additionally, Nexus 9000 switches operating in ACI mode and Nexus 7000 switches are confirmed to be unaffected.

Administrators can check the status of NGOAM using the command: `show feature | include ngoam`. Relevant checks for overlay and SRv6 can be done with the commands: `show feature | include nve` and `show feature | include srv6`.

For overlay exposure, Cisco additionally lists show running-config | begin "interface nve", show nve vni, and show nve peers to inspect the required configuration and peer state.

Cisco has stated that no workarounds exist for these vulnerabilities. However, disabling NGOAM when it is not necessary removes the attack vector for all three vulnerabilities. Administrators can execute the command `no feature ngoam` in global configuration mode after evaluating the operational consequences.

Additionally, Cisco has released Live Protect shields as temporary mitigations. These protections bridge the gap until administrators can schedule software upgrades and are not a replacement for installing a fixed release.

Organizations should use the Cisco Software Checker to identify affected releases and suitable upgrade targets. The advisory does not include a fixed-version table.

At the time of publication, Cisco’s PSIRT reported no known public announcements or malicious exploitation of these vulnerabilities. Nonetheless, this assessment does not eliminate the need to remediate affected switches.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.