IT SBIT Services
Schneeberger
DEEN
CVE tracker

Cisco NX-OS: Remote code execution in VXLAN OAM (NGOAM)

CVE-2026-76485Critical 9.8

← All vulnerabilities

Summary

A flaw in the VXLAN OAM feature (NGOAM) of Cisco NX-OS on Nexus 3000 and 9000 Series switches in standalone mode allows an unauthenticated remote attacker to execute arbitrary code with root privileges or to crash the process and reload the device. The attacker only needs to send crafted IP packets to an interface of the switch, and the flaw is only exploitable when NGOAM is enabled. Cisco rates the issue as critical (CVSS 9.8).

Affected

  • Cisco Nexus 3000 and 9000 Series switches in standalone NX-OS mode with NGOAM enabled
  • Releases listed in the CVE record: 9.2(1), 9.2(2), 9.2(2t), 9.2(2v), 9.2(3), 9.2(3y), 9.2(4), 9.3(1), 9.3(1z), 9.3(2), 9.3(3), 9.3(4)
  • Nexus 9000 Series switches in ACI mode are not affected
  • Check the affected releases in the Cisco advisory, because the list may be incomplete

Fixed in

Unknown. Cisco has released software updates, but the first fixed release per platform was not available in the sources. Use the Cisco Software Checker for the fixed release.

Workaround

  • Cisco states that no workarounds are available.
  • Cisco has released Live Protect shields as temporary mitigations.
  • Secondary sources say that disabling NGOAM (no feature ngoam) removes the attack vector. This is not confirmed by Cisco and must be tested in a lab first.

Exploitation

  • Cisco PSIRT is not aware of any public announcements or malicious use.
  • CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
  • No public proof of concept was found; this is unknown and not confirmed absent.
  • Not listed in the CISA KEV catalog according to the sources checked.

Our recommendation

  • Run 'show feature | include ngoam' on every Nexus 3000 and standalone 9000 switch.
  • If NGOAM is enabled and not required, disable it after checking the operational impact.
  • Keep Live Protect shields in place until the patch is installed.
  • Obtain the fixed release for each platform from the Cisco Software Checker and schedule the upgrade.
  • Restrict access to the switch IP interfaces to trusted segments only.
  • Monitor for unexpected OAM process crashes or unplanned reloads.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:41.

Original description (NVD)

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed