CVE-2026-76485: Cisco Nexus NGOAM Remote Code Execution

CVE-2026-76485 affects Cisco Nexus 3000 and 9000 switches in standalone NX-OS mode when NGOAM is enabled. Check the feature state, assess service impact before disabling NGOAM, and use Cisco Software Checker for the fixed release for your platform and branch.^{[1], [2]}

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

💡 Plain English Explainer (ELI5)

Think of a switch feature as an extra service door in a secured building. When NGOAM is enabled, Cisco says malformed network traffic can reach an input-handling weakness through that door. The safe first step is to check whether the door is open; closing it may interrupt network operations, so disable the feature only when your design does not need it and the impact is approved.^[1]

Core Concepts & Subsystem Terms

NGOAM: NGOAM (Next Generation OAM): Nexus network operations and maintenance functionality.^[1]
Standalone NX-OS: The NX-OS operating mode covered by this advisory; Nexus 9000 in ACI mode is listed as not affected.^[1]
First Fixed release: The earliest Cisco software release that addresses this advisory for the selected product, platform, and branch.^[2]

Framework mappings

CWE reference for the weakness described in this guide: CWE-121

Root Cause Analysis

Cisco attributes CVE-2026-76485 to improper validation of IP traffic when Next Generation OAM (NGOAM) is enabled on Cisco Nexus 3000 or 9000 Series switches in standalone NX-OS mode. Cisco describes crafted packets sent to an IP interface as the attack path and rates the issue CVSS 3.1 9.8 Critical, CWE-121. A successful attack could execute code with root privileges or cause a denial of service. Cisco says the vulnerability was found during internal testing and PSIRT was not aware of public announcements or malicious use when the advisory was published on 2026-10-07. Cisco publishes no vulnerable source or patch diff; the configuration below is an exposure check and conditional mitigation, not a code-level reconstruction. The same advisory covers CVE-2026-76486 and CVE-2026-76501, but those have additional SRv6 or NV Overlay prerequisites; do not transfer their conditions to CVE-2026-76485.^[1]

CVE-2026-76485 applicability and remediation

Platform / state	What the advisory says	Operator decision
Nexus 3000/9000, standalone NX-OS, NGOAM enabled	This is the documented affected configuration.	Capture `show feature \| include ngoam`; assess exposure and upgrade to the release selected for this exact platform.
Standalone NX-OS, NGOAM disabled	The NGOAM configuration prerequisite is absent; disabling it is only a temporary mitigation when the feature is not needed.	Do not treat feature state as a software fix. Confirm operational impact and still plan the applicable upgrade.
Nexus 9000 in ACI mode	Cisco confirms this mode is not affected by this advisory.	Record the mode; do not apply the standalone NX-OS exposure statement to it.
Fixed release selection	There is no universal NX-OS fixed version in the advisory; the first fixed release depends on exact product, platform, and installed release.	Use Cisco Software Checker for the device-specific fixed release.
Related `CVE-2026-76486` / `CVE-2026-76501`	These sibling flaws have additional SRv6 or NV Overlay prerequisites.	Assess each CVE against its own feature conditions; do not infer its exposure from this matrix row.

Step-by-Step Attack Flow

Step 1

Check platform and operating mode

Confirm the device is a Nexus 3000 or 9000 running standalone NX-OS. Cisco says ACI-mode Nexus 9000 and other listed products are not affected by this advisory.^[1]

Step 2

Check NGOAM state

Run show feature | include ngoam. An enabled NGOAM feature meets the configuration prerequisite for CVE-2026-76485; this command is a local configuration check, not an exploit test.^[1]

Step 3

Bound the exposure

The flaw is described as unauthenticated and network-reachable through crafted IP traffic to an interface. Cisco does not publish packet details or a source-level call chain, so do not infer a specific parser or memory layout.^[1]

Step 4

Choose mitigation or upgrade

If NGOAM is not required, Cisco says no feature ngoam removes the attack vector for all three flaws, but warns it may affect network function. Otherwise use Cisco Software Checker for the exact platform and installed release, then upgrade to its first fixed release.^{[1], [2]}

Source Code: Flaw vs. Secure Implementation

Cisco advises that disabling NGOAM removes the attack vector only when the feature is not required; assess service impact before applying. The command is a vendor-documented mitigation, not a substitute for the fixed software release. The vulnerable pane represents the enabled feature state and is not source code.^[1]

Source excerpt: Illustrative operator configuration state; not Cisco source code

UNPATCHED FLAW

! Illustrative exposed configuration state, not vulnerable source code
feature ngoam
! Confirm status with: show feature | include ngoam

HARDENED SECURE PATCH

! Only if NGOAM is not required and impact is approved
configure terminal
no feature ngoam
end
! Verify status with: show feature | include ngoam

Engineering & System Hardening Checklist

✓Inventory Nexus 3000/9000 devices and confirm whether each runs standalone NX-OS or ACI mode.^[1]
✓Capture show feature | include ngoam output for every standalone device; do not infer exposure from model family alone.^[1]
✓For sibling CVE-2026-76486, separately check SRv6 or NV Overlay and the documented VNI/NVE/learned-peer conditions; for CVE-2026-76501, check NGOAM plus SRv6.^[1]
✓Use Cisco Software Checker with the exact product, platform, and installed release to identify the first fixed version; do not apply a version from another branch.^[2]
✓Disable NGOAM with no feature ngoam only when the feature is not operationally required and the network owner approves the impact.^[1]
✓Plan and verify an upgrade to the applicable fixed release; treat Cisco Live Protect shields as temporary mitigation, not remediation.^[1]
✓Check Cisco PSIRT updates for exploitation status; the October 7 advisory reported no known malicious use at publication.^[1]