CriticalCVECVE-2026-76485
Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges
Cyber Security News·Source published ·1 min read
What happened?
Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code with root privileges without logging in. The flaws affect the Next Generation Operation, Administration, and Maintenance feature, known as NGOAM, in Cisco NX-OS Software. Successful attacks could also crash processes, force switches to reload, and disrupt network services. Published on October 7, 2026, Cisco’s security advisory covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The advisory carries a CVSS base score of 9.8.
Key details
- Three NX-OS flaws allow unauthenticated remote code execution with root privileges on Nexus 3000 and 9000 Series switches.
- The vulnerabilities stem from improper validation of incoming IP traffic when NGOAM is enabled on affected switches.
- CVE-2026-76485 requires only NGOAM to be enabled for exploitation.
- CVE-2026-76486 requires NGOAM alongside SRv6 or a qualifying Network Virtualization Overlay configuration with specific VXLAN EVPN mapping.
- Nexus 9000 switches in ACI mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not affected by these vulnerabilities.
Affected
- Nexus 3000 and 9000 Series switches in standalone NX-OS mode with NGOAM enabled.
- Nexus 9000 models that support SRv6 and have the required overlay configuration.
- Nexus 9000 switches running in ACI mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not affected.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.