Cisco published security advisory cisco-sa-ngoam-rce-LWKQ4BU on October 7, 2026, covering three critical vulnerabilities — CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 — in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of NX-OS software on Nexus 3000 and standalone-mode 9000 Series switches. Each scores CVSS 9.8: an unauthenticated remote attacker can send crafted packets to an IP interface and execute code with root privileges, or crash processes and force device reloads in a denial-of-service attack.
The flaws stem from improper validation of incoming IP traffic when NGOAM is enabled — the feature's stack-based buffer handling fails to sanitize packets before processing. Exposure differs by CVE: CVE-2026-76486 also requires SRv6 or NV Overlay to be enabled, and CVE-2026-76501 requires SRv6, which is supported only on some Nexus 9000 models. A sibling advisory disclosed the same day covers CVE-2026-76465, a CVSS 9.8 flaw in the MPLS OAM feature on the same platforms; that feature is disabled by default, and Nexus 9000 switches with Silicon One ASICs do not support it. Nexus 7000 switches and Nexus 9000 switches in ACI mode are not affected by any of the five flaws.
Cisco found the vulnerabilities during internal security testing and said its incident response team was not aware of any public announcements or malicious exploitation at publication. There are no workarounds: patching is the only remediation, and Cisco explicitly recommends disabling NGOAM if it is not needed to eliminate the attack vector. For switches that cannot yet be upgraded and rebooted, Cisco provides temporary Live Protect shields. Fixed releases include NX-OS 10.3(10), 10.4(8), 10.5(6), and 10.6(4) for the standalone trains; administrators should confirm their exact train in Cisco's Software Checker.
The Nexus bundle was part of a wider October 7 security release spanning 18 CVEs, seven of them critical — including a CVSS 10.0 cryptographic signature verification bypass (CVE-2026-76482) and an unauthenticated password reset flaw (CVE-2026-20328) in License On-Prem, plus CVEs in the NX-API management interface. NGOAM itself has history as an attack surface: a 2021 denial-of-service advisory targeted the same feature, which argues for leaving it off wherever the troubleshooting functions are not in active use.
For network teams, the drill is familiar but urgent: pull "show feature" output from every switch and hunt for an unexpected "enabled" on NGOAM, verify software trains against the advisory, schedule maintenance windows, and watch logs for unexplained process crashes or reloads — Cisco notes failed exploitation can leave those traces. No public proof-of-concept code is known, which keeps the exposure window open but gives teams a head start that older disclosure patterns did not always allow.