HackedWire
Newsletter

Vulnerabilities

Cisco Patches Three Critical 9.8 NX-OS Flaws Allowing Root Code Execution on Nexus Switches

Three stack-based buffer overflows in the NGOAM feature let unauthenticated attackers run arbitrary code with root privileges on Nexus 3000 and 9000 Series switches. Cisco says there are no workarounds — patching is the only remediation.

By Devon Cross, Correspondent — vulnerabilities & security research ·

Building 10 of the Cisco San Jose main campus, home to Cisco's executive offices.
Building 10 of the Cisco San Jose main campus, home to Cisco’s executive offices.

Photo: Travis Wise, CC BY 2.0, via Wikimedia Commons

Cisco published security advisory cisco-sa-ngoam-rce-LWKQ4BU on Oct. 7, covering CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 — three critical vulnerabilities (CVSS 9.8) in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of Cisco NX-OS Software. They allow unauthenticated remote attackers to execute arbitrary code with root privileges on Nexus 3000 and 9000 Series switches.

The flaws are stack-based buffer overflows (CWE-121) caused by improper input validation of IP traffic when NGOAM is enabled. Exploitation sends specially crafted packets to an IP interface — and can also crash processes, force device reloads, and cause denial of service.

The Cisco Systems main campus in San Jose, California.
The Cisco Systems main campus in San Jose, California.

Photo: Mike Linksvayer, CC0, via Wikimedia Commons

Exposure differs by flaw

  • CVE-2026-76485 requires only that NGOAM is enabled.
  • CVE-2026-76486 requires NGOAM plus SRv6 or NV Overlay.
  • CVE-2026-76501 requires NGOAM plus SRv6.

Cisco discovered the vulnerabilities during internal security testing. Its Product Security Incident Response Team said it was not aware of any public announcements or malicious use of the flaws at the time of release — and none of the flaws were known to be exploited or listed in CISA’s Known Exploited Vulnerabilities catalog as of Oct. 7.

A broader October release

The Oct. 7 release was part of a larger cycle: ThreatAft reports Cisco published advisories covering 18 CVEs across NX-OS and License On-Prem, seven of them critical. The standouts include CVE-2026-76482 (CVSS 10.0, improper cryptographic signature verification in License On-Prem), CVE-2026-76480 (CVSS 9.8, missing authentication in License On-Prem), CVE-2026-20328 (CVSS 9.1, unauthenticated password reset of any account), and CVE-2026-76471 (CVSS 9.8, NX-API remote code execution). Severity scores come from Cisco/ThreatAft reporting; confirm them against NVD entries before acting on a single figure.

Mitigation: patch — that’s it

Software updates are available, and Cisco lists no workarounds: patching is the only remediation. Nexus administrators should inventory where NGOAM is enabled — CVE-2026-76485 needs nothing more than that — and schedule the fixed software, prioritizing internet-reachable or otherwise exposed management planes. Exact affected and fixed software versions are in the official advisory linked above.

What remains unknown

  • Whether any of the broader-cycle flaws see exploitation in the wild; watch CISA KEV for additions.
  • There was no CISA alert for this release as of Oct. 10.

Corrections: No corrections have been published for this article.

About the author

Devon Cross is a HackedWire correspondent covering vulnerabilities & security research. More from Devon Cross →

Patch Tuesday, every day

Get HackedWire’s vulnerability coverage in your inbox. Subscribe to the newsletter →