CVE-2026-76486

Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability

State: Published
Severity: 9.8 Critical
Published: Oct 7, 2026
Updated: Oct 8, 2026
Reserved: Aug 19, 2026

Description

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.

This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	cisco

Weaknesses

CWE-121 Stack-based Buffer Overflow

Affected Products

Product	Versions
Cisco NX-OS SoftwareCisco	9.3(3)Affected 9.3(4)Affected 9.3(5)Affected 9.3(6)Affected 9.3(5w)Affected 9.3(7)Affected 9.3(7k)Affected 9.3(7a)Affected 9.3(8)Affected 9.3(9)Affected 9.3(10)Affected 10.3(1)Affected 10.3(2)Affected 9.3(11)Affected 10.3(3)Affected 9.3(12)Affected 10.4(1)Affected 10.3(99w)Affected 10.3(3w)Affected 10.3(99x)Affected 10.3(3o)Affected 10.3(4)Affected 10.3(3p)Affected 10.3(4a)Affected 10.4(2)Affected and 38 more versions

Product

Versions

Cisco NX-OS SoftwareCisco

9.3(3)Affected
9.3(4)Affected
9.3(5)Affected
9.3(6)Affected
9.3(5w)Affected
9.3(7)Affected
9.3(7k)Affected
9.3(7a)Affected
9.3(8)Affected
9.3(9)Affected
9.3(10)Affected
10.3(1)Affected
10.3(2)Affected
9.3(11)Affected
10.3(3)Affected
9.3(12)Affected
10.4(1)Affected
10.3(99w)Affected
10.3(3w)Affected
10.3(99x)Affected
10.3(3o)Affected
10.3(4)Affected
10.3(3p)Affected
10.3(4a)Affected
10.4(2)Affected
and 38 more versions

References

cisco-sa-ngoam-rce-LWKQ4BU

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.