Critical Cisco Nexus Flaws Allow Unauthenticated Root Privilege Escalation
Three critical vulnerabilities in Cisco Nexus 3000 and 9000 Series switches, affecting the NGOAM feature, allow unauthenticated remote attackers to execute code with root privileges.
Cisco has issued urgent security updates for three critical vulnerabilities discovered in its Nexus 3000 and 9000 Series switches. These flaws, residing within the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of Cisco NX-OS Software, could permit unauthenticated remote attackers to gain complete control of the affected devices by executing code with root privileges. The vulnerabilities carry a severe CVSS base score of 9.8, highlighting their significant potential impact.
According to Cisco's advisory, published on October 7, 2026, the vulnerabilities are identified as CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The company stated that these flaws were uncovered during internal security testing, and there was no awareness of public exploitation or malicious activity at the time of the advisory's release. The root cause of these vulnerabilities lies in the improper validation of incoming IP traffic when the NGOAM feature is enabled on the switches.
An attacker can exploit these weaknesses by sending specially crafted IP packets to an interface on a vulnerable switch. If successful, these packets can trigger code execution with the highest level of privilege, effectively granting the attacker full administrative control over the switch's operating system. Beyond code execution, the same attack vectors can also lead to denial-of-service conditions, causing critical processes to crash and potentially forcing the devices to reload, thereby disrupting essential network services.
The specific conditions for exploitation vary across the three CVEs, making it crucial for administrators to assess their configurations carefully. CVE-2026-76485 requires only the NGOAM feature to be enabled. CVE-2026-76486 necessitates NGOAM along with either Segment Routing over IPv6 (SRv6) or a specific Network Virtualization Overlay (NVO) configuration, particularly involving VXLAN EVPN. CVE-2026-76501 demands both NGOAM and SRv6 to be active.
Cisco has clarified that certain product lines are not affected. Specifically, Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode are impacted. However, Nexus 9000 switches running in Application Centric Infrastructure (ACI) mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not vulnerable to these specific flaws. Administrators can verify the status of enabled features like NGOAM, NVE, and SRv6 using specific show commands within the NX-OS CLI.
While no direct workarounds exist to fully mitigate these vulnerabilities, Cisco strongly recommends disabling the NGOAM feature if it is not essential for network operations. This can be achieved using the no feature ngoam command in global configuration mode, though administrators must carefully evaluate the potential impact on network functionality before proceeding. Cisco has also released Live Protect shields as a temporary measure, but these are not a substitute for applying the official software patches.
Organizations are urged to consult the Cisco Software Checker tool to identify the correct patched NX-OS version for their specific hardware platform and to schedule the necessary upgrades as soon as possible. This advisory is separate from previous Cisco Nexus vulnerabilities, such as CVE-2026-20212 affecting Silicon One models, and requires independent assessment and remediation.
The exploitation of these critical flaws could have severe consequences for network stability and security, potentially allowing attackers to disrupt operations, gain unauthorized access, or pivot to other parts of the network. Prompt patching and configuration review are paramount to protecting these core network infrastructure devices.