Cisco Nexus 3000 and 9000 Series Switches MPLS OAM remote code execution lets unauthenticated attackers run code (CVE-2026-76465)

What happened

MPLS OAM on Cisco NX-OS for Nexus 3000 and 9000 Series Switches does not properly validate MPLS echo-request packets. An unauthenticated, remote attacker can send a crafted MPLS echo-request to an IP address on an affected device. No user interaction or prior access is required; the attack is reachable over the network.

A successful exploit gives the attacker arbitrary code execution with root privileges. It can also crash the affected process, which may force a device reload and create a denial of service condition. Cisco assigns CVSS 3.1 score 9.8, Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

Who is affected

The affected software is Cisco NX-OS on Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches. The releases listed in Cisco's advisory are 9.3(1), 9.3(1z), 9.3(2), 9.3(3), 9.3(4), 9.3(5), 9.3(5w), and 9.3(6).

Only devices with the MPLS OAM feature enabled have the vulnerable processing path. Cisco notes that disabling the feature removes the attack vector. These are network switches, so the practical exposure is highest where an affected switch has an IP address reachable from untrusted traffic.

What to do now

1. Apply Cisco's fixed software. Cisco has released a fix for this vulnerability, but the exact fixed release names are not listed here; confirm the correct build for your NX-OS release in Cisco's advisory before upgrading.
2. If MPLS OAM is not required, disable it in global configuration mode with no feature mpls oam. Cisco states this removes the attack vector and has been proven successful in a test environment, but evaluate the impact on your own network before deploying it.
3. Cisco states there are no workarounds that address the vulnerability itself, so patching and, where appropriate, disabling MPLS OAM are the definitive measures.

How to detect it

Cisco's advisory does not publish indicators of compromise. The described outcomes to alert on are unplanned MPLS OAM process crashes and device reloads. Review syslog and monitoring for these on any Nexus 3000 or 9000 switch running the affected NX-OS releases.

Beyond the patch

Because this flaw is reachable over the network without credentials, the patching window is also an exposure-management problem: until every MPLS OAM-enabled Nexus device is mitigated, any route that can reach the device can carry the crafted packet. Virtual CISO Services (vCISO) can map and prioritise that exposure, while Managed Detection & Response (MDR) can monitor for root-level execution, crashes and reloads on affected switches. For tracking Cisco's fix cycle across your estate, Supply Chain Defense & Third-Party Risk turns patch latency into measured third-party risk.