CVE-2026-76486 - Vulnerability Details

- Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability

Description

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.

This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

Published: 2026-10-07

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in the VXLAN Operation, Administration, and Maintenance feature allows an unauthenticated remote attacker to send crafted packets to an IP interface and gain root privileges or cause a denial‑of‑service. Improper input validation permits execution of arbitrary code and can bring down key processes, resulting in a device reload. This is a classic stack‑based buffer overrun flaw (CWE‑121).

Affected Systems

Cisco NX‑OS Software on Nexus 3000 and 9000 Series Switches is affected. Versions are not listed in the advisory; any device running the NGOAM feature is potentially vulnerable.

Risk and Exploitability

The CVSS score of 9.8 marks the issue as critical, with a high likelihood of exploitation over an open network, especially if the NGOAM feature is enabled. The EPSS score is unavailable, but the lack of a KEV listing does not diminish the immediate risk. An attacker does not need prior authentication, reducing the attack surface further and making the vulnerability suitable for widespread exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Cisco

Cisco NX-OS Software

unknown

Version	Status	Constraints
`9.3(3)`	affected	—
`9.3(4)`	affected	—
`9.3(5)`	affected	—
`9.3(6)`	affected	—
`9.3(5w)`	affected	—
`9.3(7)`	affected	—
`9.3(7k)`	affected	—
`9.3(7a)`	affected	—
`9.3(8)`	affected	—
`9.3(9)`	affected	—
`9.3(10)`	affected	—
`10.3(1)`	affected	—
`10.3(2)`	affected	—
`9.3(11)`	affected	—
`10.3(3)`	affected	—
`9.3(12)`	affected	—
`10.4(1)`	affected	—
`10.3(99w)`	affected	—
`10.3(3w)`	affected	—
`10.3(99x)`	affected	—
`10.3(3o)`	affected	—
`10.3(4)`	affected	—
`10.3(3p)`	affected	—
`10.3(4a)`	affected	—
`10.4(2)`	affected	—
`10.3(3q)`	affected	—
`9.3(13)`	affected	—
`10.3(5)`	affected	—
`10.4(3)`	affected	—
`10.3(3x)`	affected	—
`10.3(4g)`	affected	—
`10.5(1)`	affected	—
`10.3(3r)`	affected	—
`10.3(6)`	affected	—
`9.3(14)`	affected	—
`10.4(4)`	affected	—
`10.3(4h)`	affected	—
`10.5(2)`	affected	—
`10.3(7)`	affected	—
`10.4(5)`	affected	—
`10.5(3)`	affected	—
`9.3(15)`	affected	—
`10.4(4g)`	affected	—
`10.5(4)`	affected	—
`10.6(1)`	affected	—
`10.5(3t)`	affected	—
`10.3(8)`	affected	—
`10.4(6)`	affected	—
`10.5(3s)`	affected	—
`10.5(3e)`	affected	—
`10.5(3o)`	affected	—
`9.3(16)`	affected	—
`10.6(1s)`	affected	—
`10.6(2)`	affected	—
`10.5(3p)`	affected	—
`10.3(9)`	affected	—
`10.6(2s)`	affected	—
`10.6(3)`	affected	—
`10.4(7)`	affected	—
`10.5(5)`	affected	—
`9.3(17)`	affected	—
`10.6(2n)`	affected	—
`10.6(3s)`	affected	—

No data.

Vendor Product Confidence Versions

Cisco

Nx-os Software

87%

Version	Status	Scheme	Platform
`9.3(3)`	affected	generic	—
`9.3(4)`	affected	generic	—
`9.3(5)`	affected	generic	—
`9.3(6)`	affected	generic	—
`9.3(5w)`	affected	generic	—
`9.3(7)`	affected	generic	—
`9.3(7k)`	affected	generic	—
`9.3(7a)`	affected	generic	—
`9.3(8)`	affected	generic	—
`9.3(9)`	affected	generic	—
`9.3(10)`	affected	generic	—
`10.3(1)`	affected	generic	—
`10.3(2)`	affected	generic	—
`9.3(11)`	affected	generic	—
`10.3(3)`	affected	generic	—
`9.3(12)`	affected	generic	—
`10.4(1)`	affected	generic	—
`10.3(99w)`	affected	generic	—
`10.3(3w)`	affected	generic	—
`10.3(99x)`	affected	generic	—
`10.3(3o)`	affected	generic	—
`10.3(4)`	affected	generic	—
`10.3(3p)`	affected	generic	—
`10.3(4a)`	affected	generic	—
`10.4(2)`	affected	generic	—
`10.3(3q)`	affected	generic	—
`9.3(13)`	affected	generic	—
`10.3(5)`	affected	generic	—
`10.4(3)`	affected	generic	—
`10.3(3x)`	affected	generic	—
`10.3(4g)`	affected	generic	—
`10.5(1)`	affected	generic	—
`10.3(3r)`	affected	generic	—
`10.3(6)`	affected	generic	—
`9.3(14)`	affected	generic	—
`10.4(4)`	affected	generic	—
`10.3(4h)`	affected	generic	—
`10.5(2)`	affected	generic	—
`10.3(7)`	affected	generic	—
`10.4(5)`	affected	generic	—
`10.5(3)`	affected	generic	—
`9.3(15)`	affected	generic	—
`10.4(4g)`	affected	generic	—
`10.5(4)`	affected	generic	—
`10.6(1)`	affected	generic	—
`10.5(3t)`	affected	generic	—
`10.3(8)`	affected	generic	—
`10.4(6)`	affected	generic	—
`10.5(3s)`	affected	generic	—
`10.5(3e)`	affected	generic	—
`10.5(3o)`	affected	generic	—
`9.3(16)`	affected	generic	—
`10.6(1s)`	affected	generic	—
`10.6(2)`	affected	generic	—
`10.5(3p)`	affected	generic	—
`10.3(9)`	affected	generic	—
`10.6(2s)`	affected	generic	—
`10.6(3)`	affected	generic	—
`10.4(7)`	affected	generic	—
`10.5(5)`	affected	generic	—
`9.3(17)`	affected	generic	—
`10.6(2n)`	affected	generic	—
`10.6(3s)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Cisco NX‑OS update that contains the fix for the NGOAM RCE issue.
If a patch is not yet available, disable the NGOAM feature on all affected switches until an official update is issued.
Continuously monitor for anomalous VXLAN traffic and alert on packets that trigger OAM exceptions.

Generated by OpenCVE AI on October 7, 2026 at 18:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0054.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU

History

Fri, 09 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Cisco Cisco nx-os Software
Vendors & Products		Cisco Cisco nx-os Software

Thu, 08 Oct 2026 05:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 07 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
Title		Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability
Weaknesses		CWE-121
References		https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Cisco Nx-os Software

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2026-10-07T16:17:16.954Z

Updated: 2026-10-08T03:55:36.380Z

Reserved: 2026-08-19T12:02:03.639Z

Link: CVE-2026-76486

Vulnrichment

Updated: 2026-10-07T16:45:59.885Z

NVD

Status : Awaiting Analysis

Published: 2026-10-07T17:17:01.350

Modified: 2026-10-08T20:08:45.857

Link: CVE-2026-76486

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-09T07:30:17Z

Weaknesses

CWE-121
Stack-based Buffer Overflow

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object