Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

A Cisco advisory tracked as CVE-2026-76485 describes multiple remote code execution vulnerabilities in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of NX-OS Software running on Nexus 3000 and Nexus 9000 Series Switches. An unauthenticated, remote attacker can execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an IP interface on an affected device when NGOAM is enabled. This post covers what the flaw is, the precondition an attacker needs, how to determine whether your fleet is exposed, and what to do before this family appears on the exploited-in-the-wild lists.

What NGOAM is, and why a parser bug here is so severe

NGOAM is Cisco's successor to the classic MPLS OAM toolset for data-center fabrics. It is the plumbing behind the diagnostic commands operators reach for when a VXLAN overlay or EVPN fabric starts misbehaving: path trace, ping across a VNI, loopback across an underlay segment, pathtrace through a service chain. The switch's control plane terminates and parses a specialized OAM packet type on an IP interface and, based on fields inside that packet, generates a response or walks the fabric to produce one.

That structure is precisely where improper input validation becomes a weapon. CVE-2026-76485 is explicit: the vulnerabilities exist because NGOAM does not properly validate IP traffic when the feature is enabled, and a crafted packet aimed at an IP interface suffices to trigger them. Successful exploitation yields code execution as root or a crash in the handling process. On a top-of-rack or spine switch, root access is not just a device compromise; it is a position in the fabric from which an attacker can tamper with forwarding, mirror east-west traffic, inject routes, or pivot into management networks that assume the switch is trustworthy.

A sibling advisory, CVE-2026-76465, describes an analogous flaw in the older MPLS OAM feature on the same platforms: a malformed MPLS echo-request aimed at an IP address on the device triggers code execution or a crash. Both are variants of the same class of defect: a control-plane parser reachable without authentication, on a protocol that operators rarely treat as a security boundary.

Precondition: what an attacker actually needs

The attack surface narrows to one condition: NGOAM must be enabled. NGOAM is not on by default; operators enable it for fabric diagnostics or when automation tools drive their own health checks. When NGOAM is disabled, the vulnerable code path is not reachable.

When NGOAM is enabled, the precondition reduces to IP reachability to any IP interface on the switch. In many data-center designs, loopbacks and SVIs on leaf and spine switches are reachable from any workload VRF that participates in the fabric, from the out-of-band management network, and from jump hosts used by network operations. A tenant-side compromise, a stray flat subnet, or an exposed management interface each satisfy the reachability requirement without credentials.

The attack requires no authentication and no user interaction. One crafted packet to one IP on the switch, with the feature enabled, is sufficient.

Determining exposure

Three questions decide whether a given switch is exposed to CVE-2026-76485:

1. Is this platform in scope (Nexus 3000 or Nexus 9000 running NX-OS)?
2. Is the NX-OS release among the fixed versions in the advisory?
3. Is NGOAM enabled on the device?

The first two are an inventory lookup against the advisory's fixed-release table. The third is a configuration check. On NX-OS, NGOAM is gated behind feature ngoam, and operational state is visible in the running configuration and in the OAM show commands:

switch# show running-config | include '^feature ngoam'
feature ngoam

switch# show feature | include ngoam
ngoam                 1          enabled

switch# show ngoam summary
NGOAM is enabled

A fleet-scale version of the same check collects, per device, the platform family, the NX-OS version, and whether feature ngoam is configured. A minimal SSH pattern over an example inventory:

# example.com inventory; replace with your own source of truth
while read host; do
  ssh -o BatchMode=yes "netops@${host}" '
    show version | include "NXOS: version"
    show inventory | include "Chassis"
    show running-config | include "^feature ngoam"
  ' | awk -v h="$host" 'BEGIN{print "=== "h" ==="}{print}'
done < switches.txt

Devices that return no feature ngoam line are not exposed to this specific family today, but that status can change with the next automation push. Treat the inventory output as a point-in-time snapshot and re-run it after any fabric change.

The NX-API advisory CVE-2026-76471 is worth checking in the same pass. It describes an unauthenticated RCE through the NX-API HTTP interface, governed by whether NX-API is enabled and whether its listener is reachable. The exposure questions follow the same shape: feature state, interface reachability, software version.

What to do before this reaches the exploited-in-the-wild lists

Cisco's advisory provides software updates and describes no configuration workaround for CVE-2026-76485 other than disabling the feature. Three defensive moves are worth sequencing now, before any public exploit surfaces.

First, patch on the schedule your change windows allow, prioritizing devices where NGOAM is enabled and where IP interfaces are reachable from untrusted or semi-trusted zones. Organizations under US federal remediation obligations should note that CISA's current KEV directive, BOD 26-04 (Prioritizing Security Updates Based on Risk), carries the KEV criteria forward from the superseded BOD 22-01; the obligation to remediate activates once an entry lands on the catalog, so a pre-KEV patch is cheaper than a post-KEV scramble.

Second, where patching cannot happen quickly, disable NGOAM on devices that do not need it. The feature is a diagnostic convenience; many fabrics tolerate it being off between troubleshooting sessions, and disabling it removes the vulnerable parser from the reachable attack surface.

Third, constrain reachability to switch IP interfaces. Control-plane policing and infrastructure ACLs that block OAM packet types from tenant VRFs and from networks that do not legitimately originate fabric diagnostics will not fix the bug, but they reduce the set of positions from which the single-packet precondition is satisfiable. On a pre-authentication bug reachable over IP, every hop of reachability removed is a hop an attacker must earn.

Verifiable security.