Cisco Patches Four Critical Nexus Switch Flaws That Allow Root-Level Remote Code Execution

TL;DR

Cisco has released fixes for four critical Cisco Nexus vulnerabilities, each rated 9.8 on CVSS. The flaws sit in the OAM features of NX-OS on Nexus 3000 and 9000 Series switches. An unauthenticated remote attacker could run code with root privileges or crash the device.

Why It Matters

Nexus 3000 and 9000 switches form the backbone of many data center networks. Root access on one of them gives an attacker a strong foothold inside that network. Even a crash can cause a reload and cut traffic.

Cisco found all four bugs during internal security testing. Its PSIRT “is not aware of any public announcements or malicious use” of these flaws. There are no true workarounds, though Cisco offers temporary mitigations.

How the Attacks Work

NGOAM Flaws

Three bugs affect Next Generation OAM (NGOAM), a feature for loop detection and path diagnostics. According to the NGOAM advisory, they stem from “improper input validation of IP traffic when NGOAM is enabled.” An attacker sends crafted packets to an IP interface on the switch. A successful attack “could allow the attacker to execute arbitrary code with root privileges.”

Each NGOAM flaw needs different settings:

• CVE-2026-76485: NGOAM enabled is the only requirement.
• CVE-2026-76486: NGOAM plus either SRv6 or NV Overlay with an active VXLAN EVPN peer.
• CVE-2026-76501: NGOAM plus SRv6.

MPLS OAM Flaw

The fourth bug, CVE-2026-76465, lives in the MPLS OAM feature. The MPLS OAM advisory says it is “due to improper validation when an affected device is processing an MPLS echo-request packet.” A single crafted echo-request sent to the switch could trigger code execution or a reload.

Affected Versions

These Cisco Nexus vulnerabilities affect Nexus 3000 Series switches and Nexus 9000 Series switches in standalone NX-OS mode. However, only devices with the relevant feature turned on are exposed.

MPLS OAM “is disabled by default,” and Nexus 9000 switches with a Silicon One ASIC cannot enable it. Similarly, Nexus 3000 switches do not support SRv6. Nexus 9000 switches in ACI mode, Nexus 7000 switches, MDS 9000 switches and several firewall and UCS lines are not affected. Cisco does not list fixed releases in the advisory text. Instead, it points admins to the Cisco Software Checker.

Patch and Mitigation Steps

First, check exposure. Running “show feature | include ngoam” or “show feature | include mpls_oam” shows whether either feature is enabled. Next, use the Cisco Software Checker to find the first fixed NX-OS release for your platform, and upgrade.

If an upgrade must wait, Cisco suggests two temporary options:

• Disable NGOAM or MPLS OAM if you do not need them. This removes the attack vector.
• Apply Cisco’s Live Protect shields, which cover all four CVEs.

Cisco stresses that these shields “are temporary mitigations to bridge the gap until software updates can be scheduled.” Because the Cisco Nexus vulnerabilities need no login, internet- or tenant-facing switches should move to the front of the patch queue.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.