Cisco NX-OS: Remote code execution in MPLS OAM
Summary
A flaw in the MPLS Operations, Administration and Maintenance (OAM) feature of Cisco NX-OS on Nexus 3000 and 9000 Series switches allows improper validation of MPLS echo-request packets. An unauthenticated remote attacker can send a crafted packet to a device IP address to execute arbitrary code with root privileges or cause a denial of service through process crashes and device reloads. The vulnerability only applies if MPLS OAM is enabled, which is disabled by default.
Affected
- Cisco Nexus 3000 Series switches running a vulnerable NX-OS release with MPLS OAM enabled
- Cisco Nexus 9000 Series switches in standalone NX-OS mode running a vulnerable release with MPLS OAM enabled
- Not affected: Nexus 9000 switches with Silicon One ASICs (feature cannot be enabled), Nexus 7000 and ACI-mode Nexus 9000
- Affected release list: Unknown. Verify in Cisco's Software Checker.
Fixed in
Unknown. Cisco has released fixed software, but the advisory does not list the fixed release numbers in the retrieved text. Determine the first fixed release per train with Cisco's Software Checker.
Workaround
- No workaround fully addresses the vulnerability according to Cisco.
- Check status: show feature | include mpls_oam
- Disable the feature if not required: no feature mpls oam (global configuration mode)
- Cisco has released a temporary Live Protect shield for NX-OS; it is not a fix.
Exploitation
- Cisco PSIRT is not aware of public announcements or malicious use.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof of concept found at the time of research; not listed in CISA KEV as far as checked.
Our recommendation
- Check whether any Nexus 3000 or 9000 switch runs standalone NX-OS and has mpls_oam enabled.
- If MPLS OAM is not required, run no feature mpls oam now.
- Identify fixed releases with Cisco's Software Checker and schedule the upgrade.
- Restrict access to switch management and control-plane interfaces from untrusted networks.
- Monitor for unusual MPLS echo traffic and device reloads.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-moam-rce-uBTzYV7 sec.cloudapps.cisco.com
- BleepingComputer: Cisco warns of critical flaws allowing Nexus switch takeover www.bleepingcomputer.com
- Cisco Security Advisory notice cisco-sa-notice-fBn58ELx sec.cloudapps.cisco.com
- Aviatrix: Cisco Nexus switch takeover vulnerabilities 2026 aviatrix.ai
- Cyber-Defence: CVE-2026-76465 www.cyber-defence.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:45.
Original description (NVD)
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.