Cisco NX-OS Nexus 9000: Remote code execution via SRv6 OAM (NGOAM)
Summary
Cisco NX-OS Software on Nexus 9000 Series switches in standalone mode contains an improper input validation flaw in the NGOAM feature of SRv6 Operation, Administration, and Maintenance (CWE-121). An unauthenticated remote attacker who sends crafted packets to an IP interface of the switch can execute arbitrary code with root privileges or crash the process, which causes a reload and denial of service. The vulnerability only applies when both NGOAM and SRv6 are enabled, and only on SRv6-capable models. Nexus 3000, Nexus 7000 and ACI-mode devices are not affected.
Affected
- Cisco Nexus 9000 Series switches in standalone NX-OS mode
- Only if NGOAM and SRv6 are both enabled (show feature | include ngoam; show feature | include srv6)
- The CVE record lists NX-OS releases 9.3(3) to 10.3(1); check Cisco's advisory and Software Checker for the exact affected releases
- Not affected: Nexus 3000 Series (no SRv6 support), Nexus 7000 Series, Nexus 9000 in ACI mode
Fixed in
Unknown. Cisco has released software updates, but the fixed release per train is not confirmed in the sources reviewed. Use the Cisco Software Checker to determine the first fixed release.
Workaround
- The advisory header lists no workarounds.
- Cisco describes disabling NGOAM (no feature ngoam in global configuration mode) as a mitigation that removes the attack vector. Cisco calls this a temporary measure until an upgrade is installed.
- Restrict access to switch IP interfaces with ACLs and management-plane filtering.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof-of-concept exploit found.
Our recommendation
- Run show feature | include ngoam, show feature | include srv6 and show feature | include nve on all Nexus 9000 switches.
- If SRv6 is not used, disable NGOAM (no feature ngoam) as a mitigation.
- If SRv6 and NGOAM are required, determine the fixed release with the Cisco Software Checker and plan the upgrade promptly.
- Limit reachability of switch IP interfaces from untrusted network segments.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-ngoam-rce-LWKQ4BU sec.cloudapps.cisco.com
- Cisco Security Advisory (Japanese) www.cisco.com
- CVE-2026-76501 record (cvefeed) cvefeed.io
- CVE-2026-76501 (VulDB) vuldb.com
- CVE-2026-76501 (OpenCVE) app.opencve.io
- Secure-ISS analysis of Cisco NX-OS vulnerabilities www.secure-iss.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:38.
Original description (NVD)
A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.