Cisco NX-OS: Remote code execution in VXLAN OAM (NGOAM)

Summary

A flaw in the NGOAM (Next Generation Operation, Administration and Maintenance) feature of Cisco NX-OS on Nexus 3000 and 9000 Series switches allows improper input validation of IP traffic. An unauthenticated remote attacker who sends crafted packets to an IP interface of an affected switch can execute arbitrary code with root privileges or crash processes, causing a reload and denial of service. Exposure requires NGOAM enabled together with SRv6 or NV Overlay, and only standalone NX-OS mode is affected.

Affected

• Cisco Nexus 3000 and 9000 Series switches in standalone NX-OS mode
• Only if NGOAM is enabled and either SRv6 or NV Overlay is enabled (NV Overlay also requires a VXLAN EVPN VNI mapped to an NVE interface with at least one learned peer VTEP)
• Affected releases listed in the advisory include 9.3(3) to 10.3(1); verify the full list in the Cisco Software Checker
• Not affected: Nexus 7000, Nexus 9000 in ACI mode, and other Cisco products listed in the advisory

Fixed in

Unknown. Cisco has released software updates; determine the fixed release for your train with the Cisco Software Checker.

Workaround

• Disable NGOAM if it is not needed (no feature ngoam in global configuration mode); Cisco lists this as the mitigation
• Cisco has offered Live Protect shields as temporary mitigation
• Restrict inbound IP traffic to switch interfaces with ACLs (third-party guidance)
• Note: the advisory header states no workarounds are available; the measures above are temporary

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use
• CISA SSVC: exploitation none, automatable yes, technical impact total
• No public proof-of-concept found in the sources reviewed; not listed in KEV according to one source

Our recommendation

• Check whether NGOAM is enabled (show feature | include ngoam) and whether SRv6 or NV Overlay is in use
• If NGOAM is not required, disable it and restrict access to switch IP interfaces
• Identify fixed releases with the Cisco Software Checker and patch affected switches
• Monitor for unusual traffic to switch interfaces and reloads

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-ngoam-rce-LWKQ4BU sec.cloudapps.cisco.com
• OpenCVE CVE-2026-76486 app.opencve.io
• VulDB 415091 vuldb.com
• Strix CVE-2026-76486 www.strix.ai
• TheHackerWire CVE-2026-76486 www.thehackerwire.com
• BleepingComputer: Cisco warns of critical flaws allowing Nexus switch takeover www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:42.