Full Report
Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]
Analysis Summary
# Vulnerability: Critical Remote Code Execution in Cisco NX-OS
## CVE Details
* **CVE-2026-76471**: CVSS 9.8 (Critical) - NX-API Input Validation Flaw
* **CVE-2026-76485**: CVSS 9.8 (Critical) - NGOAM IP Traffic Validation Flaw
* **CVE-2026-76486**: CVSS 9.8 (Critical) - NGOAM IP Traffic Validation Flaw
* **CVE-2026-76501**: CVSS 9.8 (Critical) - NGOAM IP Traffic Validation Flaw
* **CVE-2026-76465**: CVSS 9.8 (Critical) - MPLS OAM Echo-Request Validation Flaw
* **CWE**: CWE-20 (Improper Input Validation)
## Affected Systems
* **Products**: Cisco Nexus 3000 Series and Nexus 9000 Series Switches.
* **Versions**: All versions prior to the fixed releases identified by the Cisco Software Checker.
* **Configurations**:
* Standalone NX-OS mode (ACI mode is **not** affected).
* Specific features must be enabled: NX-API (CVE-2026-76471), NGOAM (CVE-2026-76485/86/501), or MPLS OAM (CVE-2026-76465).
* **Note**: Nexus 9000 switches with Silicon One ASICs are exempt from the MPLS OAM flaw.
## Vulnerability Description
These vulnerabilities stem from improper validation of input data within the NX-OS network operating system. Depending on the specific CVE, the flaw exists in the NX-API, Next Generation OAM (NGOAM), or MPLS OAM features. An attacker can send crafted HTTP requests or specially formed IP/MPLS packets to an affected device, triggering a buffer overflow or logic error that allows for arbitrary code execution with **root privileges**.
## Exploitation
* **Status**: Not exploited (Discovered during internal testing; no known PoC).
* **Complexity**: Low
* **Attack Vector**: Network
## Impact
* **Confidentiality**: High (Full administrative access to the switch)
* **Integrity**: High (Ability to modify configurations and intercept traffic)
* **Availability**: High (Ability to crash processes or force a device reload/DoS)
## Remediation
### Patches
Cisco has released software updates to address these vulnerabilities. Administrators should use the **Cisco Software Checker** to identify the appropriate fixed release for their specific hardware and software train.
### Workarounds
* **Feature Deactivation**: Disable NX-API, NGOAM, or MPLS OAM features if they are not required for business operations.
* **Live Protect**: For switches that cannot be immediately rebooted, Cisco provides "Live Protect" shields to mitigate the flaws temporarily.
## Detection
* **Indicators of Compromise**: Monitor for unexpected device reloads or unauthorized changes to the root filesystem.
* **Detection Methods**: Use Cisco’s Software Checker to audit versions. Monitor network logs for unusual HTTP traffic directed at the NX-API port or anomalous MPLS/NGOAM packets.
## References
* Cisco NX-API Advisory: [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j]
* Cisco NGOAM Advisory: [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU]
* Cisco MPLS OAM Advisory: [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7]
* Cisco Security Portal: [https://sec.cloudapps.cisco.com/security/center/publicationListing.x]