What landed in CVE-land this week

Monday's Cisco bundle reorganises a week. Across the License (Smart Software Manager) On-Prem platform, Catalyst SD-WAN Manager, NX-OS on Nexus 3000 and 9000 switches, and the Secure Firewall family (ASA, FTD, and FMC), Cisco shipped critical fixes alongside a hardening release that flags two issues under active exploitation. Two warrant close attention: the NX-OS NGOAM remote code execution flaw on Nexus 3000 and 9000 switches (CVE-2026-76485) and the Catalyst SD-WAN Manager API authentication bypass (CVE-2026-76504). Both sit directly on the control plane. Both are reachable without credentials. One is a single crafted HTTP request away from admin on the device controlling your WAN overlay.

The NGOAM flaw: unauthenticated root RCE on data-centre switches

CVE-2026-76485 covers improper-input-validation bugs in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of Cisco NX-OS. An unauthenticated remote attacker can execute arbitrary code with root privileges, or crash the device, by sending crafted packets to an IP interface on an affected Nexus 3000 or 9000 Series switch when NGOAM is enabled.

Three things make it serious:

  1. No authentication, no session, no user interaction. The attack surface is any IP interface the attacker can route to. If an attacker is already on an internal segment (inside a compromised workload, one hop from a mis-segmented OT network, or on a contractor VLAN), the switch is in scope.
  2. Root on the switch is a top-of-rack checkmate. Nexus 3000 and 9000 devices are typically the ToR or spine in modern data-centre fabrics. Root execution lets an attacker tap, mirror, or rewrite east-west traffic, pivot into the management VRF, or stage persistence that survives most endpoint-centric detection.
  3. It shares an advisory day with two other NX-OS criticals. CVE-2026-76465 covers an MPLS OAM echo-request RCE; CVE-2026-76471 covers an NX-API RCE via a crafted HTTP request. Patch windows for Nexus gear in production are costly, so operators pulling a single maintenance window should address all three.

Checking exposure

NGOAM is not enabled by default on every platform, so confirm whether your fleet runs it. On NX-OS, check the feature state and the loopback NGOAM typically uses:

switch# show feature | include ngoam
ngoam                 1          enabled
switch# show running-config | include "feature ngoam|ngoam install"
feature ngoam
ngoam install acl
switch# show ngoam interface brief

For an estate-wide view, use your network source of truth rather than SSH-walking every box. If you keep running-configs in a Git-backed NetBox or Nautobot export, a grep across the archive is faster and auditable:

$ rg -nI --glob 'configs/**/*.cfg' '^feature ngoam$' | \
    awk -F: '{print $1}' | sort -u > ngoam_enabled.txt
$ wc -l ngoam_enabled.txt

Pair that with a reachability check: NGOAM processes crafted packets destined to an IP on the device, so any Nexus whose management or in-band loopback is reachable from a user, server, or partner VLAN is a priority. Until you can apply the fix, standard infrastructure ACL hygiene applies: deny inbound traffic to switch IPs from everything except jump hosts, orchestration, and monitoring sources. If NGOAM is enabled but unused (common in many estates), disabling the feature removes the attack surface entirely.

The SD-WAN Manager auth bypass: admin by URI encoding

CVE-2026-76504 affects Cisco Catalyst SD-WAN Manager (formerly vManage). The vulnerability lies in API session-based authentication: the system mishandles URI encoding in HTTP requests, and a crafted request bypasses an authentication rule guarding a specific API endpoint. A successful exploit grants admin access.

SD-WAN Manager is the controller that pushes policy, templates, and software to every edge router in the overlay. Admin on the controller is admin on the fabric. An attacker who lands there can modify data-policy ACLs, pivot management reachability, push a crafted template that enables remote access on the WAN edge, or redirect a tenant's traffic to a path of their choosing. This is a class of flaw where detection, not patch cadence alone, is the backstop: attackers need only the window between advisory publication and your maintenance change.

What to watch for

Until the fix lands, every unauthenticated hit on the SD-WAN Manager API that returns 2xx deserves scrutiny. If you ship the manager's web-server access logs to a SIEM, a baseline query:

index=network sourcetype=sdwan_manager_access
| rex field=uri "(?<pct_seq>%[0-9A-Fa-f]{2})"
| where isnotnull(pct_seq) AND status>=200 AND status<300
| stats count values(uri) as uris by src_ip, user
| where user="-" OR user="anonymous"
| sort - count

Two patterns warrant priority triage: percent-encoded path separators (%2f, %2F, %252f) in requests to /dataservice/ endpoints, and 2xx responses on endpoints your legitimate automation never calls anonymously. Pair this with a drift check against the controller's template store: any template edit, device-group change, or admin creation inside the exposure window should be reconciled against your change-management records. If the controller sits on a public-facing management plane, move it behind a VPN or jump-host boundary while you plan the upgrade.

The hardening release and the ASA/FTD actively-exploited pair

Cisco's September 2026 Secure Firewall hardening bundle (tracked under CVE-2026-20329, with DoS component CVE-2026-20154 and SSL VPN DoS CVE-2024-20260 noted separately) stands apart in the advisory block with one line: "Two of them are known to be actively exploited." The vendor's words, not inference. These fixes should head the queue even where KEV ingestion has not caught up. The federal obligation under BOD 26-04 (Prioritizing Security Updates Based on Risk) tracks KEV; the operational obligation to patch exploited edge gear tracks the vendor's own disclosure.

Prioritisation, in order

For operators running this gear, the priority ranking for this week:

  1. The actively-exploited items in the ASA/FTD/FMC hardening release. Vendor-confirmed exploitation supersedes everything else on the list.
  2. CVE-2026-76504 on SD-WAN Manager. Unauthenticated admin on the overlay controller.
  3. The NX-OS trio: CVE-2026-76485 (NGOAM), CVE-2026-76471 (NX-API), CVE-2026-76465 (MPLS OAM). Group them into one maintenance window.
  4. CVE-2026-20328 on License On-Prem, and the ASA/FTD DoS items (CVE-2026-20154, CVE-2024-20260) where management or VPN exposure is internet-facing.

None of the critical items have workarounds that close the vulnerability; mitigations buy time, not closure. Treat exposure control (ACLs, feature disablement where unused, management-plane isolation) as the bridge, not the fix.

Verifiable security.