CVE-2026-76486
Received Received - Intake

Remote Code Execution in Cisco NX-OS via NGOAM

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-07
Last Modified
2026-10-07
Generated
2026-10-07
AI Q&A
2026-10-07
EPSS Evaluated
N/A
NVD
CVE-2026-76486
EUVD
EUVD-2026-94470

Affected Vendors & Products

Showing 63 associated CPEs
Vendor Product Version / Range
Cisco Cisco NX-OS Software 9.3(3)
Cisco Cisco NX-OS Software 9.3(4)
Cisco Cisco NX-OS Software 9.3(5)
Cisco Cisco NX-OS Software 9.3(6)
Cisco Cisco NX-OS Software 9.3(5w)
Cisco Cisco NX-OS Software 9.3(7)
Cisco Cisco NX-OS Software 9.3(7k)
Cisco Cisco NX-OS Software 9.3(7a)
Cisco Cisco NX-OS Software 9.3(8)
Cisco Cisco NX-OS Software 9.3(9)
Cisco Cisco NX-OS Software 9.3(10)
Cisco Cisco NX-OS Software 10.3(1)
Cisco Cisco NX-OS Software 10.3(2)
Cisco Cisco NX-OS Software 9.3(11)
Cisco Cisco NX-OS Software 10.3(3)
Cisco Cisco NX-OS Software 9.3(12)
Cisco Cisco NX-OS Software 10.4(1)
Cisco Cisco NX-OS Software 10.3(99w)
Cisco Cisco NX-OS Software 10.3(3w)
Cisco Cisco NX-OS Software 10.3(99x)
Cisco Cisco NX-OS Software 10.3(3o)
Cisco Cisco NX-OS Software 10.3(4)
Cisco Cisco NX-OS Software 10.3(3p)
Cisco Cisco NX-OS Software 10.3(4a)
Cisco Cisco NX-OS Software 10.4(2)
Cisco Cisco NX-OS Software 10.3(3q)
Cisco Cisco NX-OS Software 9.3(13)
Cisco Cisco NX-OS Software 10.3(5)
Cisco Cisco NX-OS Software 10.4(3)
Cisco Cisco NX-OS Software 10.3(3x)
Cisco Cisco NX-OS Software 10.3(4g)
Cisco Cisco NX-OS Software 10.5(1)
Cisco Cisco NX-OS Software 10.3(3r)
Cisco Cisco NX-OS Software 10.3(6)
Cisco Cisco NX-OS Software 9.3(14)
Cisco Cisco NX-OS Software 10.4(4)
Cisco Cisco NX-OS Software 10.3(4h)
Cisco Cisco NX-OS Software 10.5(2)
Cisco Cisco NX-OS Software 10.3(7)
Cisco Cisco NX-OS Software 10.4(5)
Cisco Cisco NX-OS Software 10.5(3)
Cisco Cisco NX-OS Software 9.3(15)
Cisco Cisco NX-OS Software 10.4(4g)
Cisco Cisco NX-OS Software 10.5(4)
Cisco Cisco NX-OS Software 10.6(1)
Cisco Cisco NX-OS Software 10.5(3t)
Cisco Cisco NX-OS Software 10.3(8)
Cisco Cisco NX-OS Software 10.4(6)
Cisco Cisco NX-OS Software 10.5(3s)
Cisco Cisco NX-OS Software 10.5(3e)
Cisco Cisco NX-OS Software 10.5(3o)
Cisco Cisco NX-OS Software 9.3(16)
Cisco Cisco NX-OS Software 10.6(1s)
Cisco Cisco NX-OS Software 10.6(2)
Cisco Cisco NX-OS Software 10.5(3p)
Cisco Cisco NX-OS Software 10.3(9)
Cisco Cisco NX-OS Software 10.6(2s)
Cisco Cisco NX-OS Software 10.6(3)
Cisco Cisco NX-OS Software 10.4(7)
Cisco Cisco NX-OS Software 10.5(5)
Cisco Cisco NX-OS Software 9.3(17)
Cisco Cisco NX-OS Software 10.6(2n)
Cisco Cisco NX-OS Software 10.6(3s)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical remote code execution vulnerability in Cisco NX-OS Software affecting Nexus 3000 and 9000 Series Switches when the NGOAM feature is enabled with SRv6 or NV Overlay. It allows unauthenticated remote attackers to execute arbitrary code with root privileges or cause a denial of service by sending crafted IP packets to an affected device.

Detection Guidance

Check if NGOAM is enabled on Cisco Nexus 3000 or 9000 Series Switches by running 'show ngoam status' or 'show running-config | include ngoam'. Verify if SRv6 or NV Overlay (including VXLAN EVPN) is configured using 'show running-config | include segment-routing|overlay|vxlan'.

Impact Analysis

Exploitation could lead to full system compromise with root access, allowing attackers to take control of the device. It may also cause device crashes, reloads, and prolonged network outages, disrupting services and operations.

Mitigation Strategies

Disable the NGOAM feature immediately if enabled. Upgrade affected Cisco Nexus devices to the latest fixed software versions provided by Cisco. Monitor network traffic for unusual packets targeting NGOAM interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76486. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart