Cisco Nexus 3000 and 9000 Series Switches NGOAM remote code execution vulnerabilities (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501)

What happened

Cisco NX-OS Software on Nexus 3000 and 9000 Series Switches has three critical remote code execution defects in the NGOAM feature. CVE-2026-76485 and CVE-2026-76486 affect VXLAN OAM; CVE-2026-76501 affects SRv6 OAM and requires both NGOAM and SRv6 features to be enabled. In every case, improper input validation of IP traffic means an unauthenticated remote attacker can send crafted packets to an IP interface on an affected switch, with no credentials or user interaction, and execute arbitrary code with root privileges or crash processes, causing a reload and denial of service. Each CVE scores 9.8 Critical under CVSS 3.1.

Cisco PSIRT states it is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory, and they have not been publicly disclosed.

Who is affected

Cisco NX-OS Software is affected on Cisco Nexus 3000 and 9000 Series Switches when NGOAM is enabled. The CVE records list these releases:

• CVE-2026-76485: 9.2(3), 9.2(2v), 9.2(1), 9.2(2t), 9.2(3y), 9.3(2), 9.2(4), 9.3(1)
• CVE-2026-76486: 9.3(3), 9.3(4), 9.3(5), 9.3(6), 9.3(5w), 9.3(7), 9.3(7k), 9.3(7a)
• CVE-2026-76501: 9.3(3), 9.3(4), 9.3(5), 9.3(6), 9.3(5w), 9.3(7), 9.3(7k), 9.3(7a)

CVE-2026-76501 is described for Cisco Nexus 9000 Series Switches and SRv6 OAM; its affected NX-OS releases are the same as those listed for CVE-2026-76486.

What to do now

1. Apply Cisco's fixed software. The exact fixed releases are in Cisco's advisory cisco-sa-ngoam-rce-LWKQ4BU; select the release for your platform.
2. If NGOAM is not required, disable it in global configuration mode with no feature ngoam. Cisco says this removes the attack vector for all three vulnerabilities, but it may affect functionality, so evaluate it in your environment first.
3. Identify which Nexus 3000 and 9000 Series Switches have NGOAM enabled and prioritise those running the affected NX-OS releases for patching.

How to detect it

Cisco has not published indicators of compromise for these vulnerabilities. Because the attack surface is limited to switches with NGOAM enabled, start by inventorying affected instances with NGOAM active. For CVE-2026-76501, also check whether SRv6 OAM is enabled. If the feature is not required, disabling it removes the exposure.

Beyond the patch

These are unauthenticated, network-reachable code execution flaws in core switching infrastructure, so exposure discovery matters as much as patching. Virtual CISO Services (vCISO) can help map which switches expose an IP interface with NGOAM active and sequence the remediation. After patching, Managed Detection & Response (MDR) monitors for code execution and unexpected reload activity on network devices.