Cisco published advisory cisco-sa-ngoam-rce-LWKQ4BU on October 7, 2026. It covers three critical flaws in the NGOAM feature of NX-OS on Nexus 3000 and Nexus 9000 Series switches running in standalone NX-OS mode.
The CVEs are CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501. Each carries a CVSS base score of 9.8. Cisco classes them as stack-based buffer overflows (CWE-121).
An unauthenticated, remote attacker can send crafted packets to an IP interface on an affected switch. The result is arbitrary code execution as root, or a denial-of-service condition. Per Cisco, CVE-2026-76485 requires only that NGOAM is enabled. CVE-2026-76501 is tied to SRv6 and, according to the advisory, affects Nexus 9000 only. Some trade outlets also list a separate MPLS OAM flaw, CVE-2026-76465.
Why it matters. These switches sit in data-centre fabrics. Root on a fabric switch gives an attacker a vantage point over east-west traffic and a path to the management plane. Unauthenticated, network-reachable bugs in infrastructure like this tend to be reverse-engineered quickly once patches ship.
Status. Cisco's PSIRT says it is not aware of public announcements or malicious use of these flaws. They were found during internal testing, as reported by BleepingComputer.
Mitigation. Cisco states no workaround fully addresses the NGOAM flaws. Upgrade to a fixed NX-OS release using Cisco's Software Checker. Where the feature is not needed, disable NGOAM, NX-API or MPLS OAM to remove the attack vector. Cisco also offers temporary Live Protect shields for switches that cannot be upgraded yet.
Blue teams: inventory Nexus 3000 and 9000 devices, confirm whether NGOAM is enabled, and restrict reachability of switch IP interfaces to management networks. Log and alert on unexpected process restarts or reloads on these devices.
