Cisco NX-OS critical flaws put Nexus fabrics on urgent patch list
Cisco
other
Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities
Cisco
other
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
Cisco
other
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability
Critical severity
Cisco assigned the NGOAM vulnerabilities a CVSS score of 9.8 and said exploitation could allow unauthenticated root-level code execution or denial of service.
Specific exposure
Affected configurations include Nexus 3000 and standalone Nexus 9000 switches with NGOAM enabled, with added VXLAN EVPN or SRv6 requirements for some CVEs.
No workaround
Cisco released fixed software and temporary Live Protect shields, but said there are no formal workarounds for the NGOAM flaws.
Cisco on October 7 disclosed multiple critical NX-OS vulnerabilities that raise the patch priority for core switching infrastructure. The disclosures include three Next Generation Operation, Administration and Maintenance flaws affecting Nexus 3000 and Nexus 9000 switches in standalone NX-OS mode when NGOAM and related fabric features are enabled.1
The NGOAM advisory covers CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501, each with a CVSS score of 9.8. Cisco said the vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause denial of service by sending crafted packets to an IP interface when vulnerable feature conditions are present.1
Cisco released fixed software and said there are no workarounds for the NGOAM vulnerabilities.1 The company said disabling NGOAM removes the attack vector if the feature is not required, but described that step as a mitigation customers should evaluate for possible functional or performance impact.1
The primary exposure is not every Nexus deployment, but specific standalone NX-OS configurations. Nexus 3000 Series switches and Nexus 9000 Series switches in standalone NX-OS mode are affected when NGOAM is enabled and additional feature requirements are met, depending on the CVE.1
For CVE-2026-76485, Cisco said the only required condition is that NGOAM is enabled.1 For CVE-2026-76486, NGOAM must be enabled and either Segment Routing over IPv6 or Network Virtualization Overlay must also be enabled. In the Network Virtualization Overlay case, Cisco said a VXLAN Ethernet VPN VNI must be mapped to a Network Virtualization Endpoint interface with at least one learned peer VXLAN Tunnel Endpoint.1 For CVE-2026-76501, both NGOAM and SRv6 must be enabled.1
Cisco noted that Nexus 3000 switches do not support SRv6, and only a subset of Nexus 9000 switches support it, narrowing exposure for the SRv6-specific NGOAM issue.1 The company said Nexus 9000 fabric switches in ACI mode, Nexus 7000 switches, MDS 9000 switches and multiple UCS fabric interconnect lines are not affected by the NGOAM advisory.1
Operations teams can check exposure using NX-OS CLI commands cited in the advisory, including show feature | include ngoam for NGOAM, show feature | include nve for Network Virtualization Overlay and show feature | include srv6 for SRv6.1 Cisco also listed show running-config | begin "interface nve", show nve vni and show nve peers as checks relevant to the CVE-2026-76486 VXLAN EVPN condition.1
The NGOAM flaws were not the only critical NX-OS issues Cisco published on October 7. A companion advisory for CVE-2026-76471 in the NX-API feature also carries a CVSS score of 9.8. It can allow unauthenticated remote code execution with root privileges or denial of service on affected Nexus 3000 and standalone Nexus 9000 switches when NX-API is enabled.2
Cisco said the NX-API issue is triggered through crafted HTTP requests to the NX-API. It affects Nexus 3000 switches, Nexus 9000 switches in standalone NX-OS mode and UCS 6300 Series Fabric Interconnects under the conditions listed in the advisory.2 The NX-API feature is disabled by default on Nexus 3000 and 9000 switches, Cisco said, making configuration review an immediate triage step.2
Cisco also published a critical MPLS OAM advisory for CVE-2026-76465 affecting Nexus 3000 and 9000 switches when MPLS OAM is enabled. That issue can also allow unauthenticated remote code execution with root privileges or denial of service, according to Cisco.3 MPLS OAM is disabled by default on Nexus 3000 and 9000 switches, and Cisco said Nexus 9000 switches with a Silicon One ASIC do not support the feature and therefore are not affected by that vulnerability.3
A separate October 2026 NX-OS hardening advisory covered multiple vulnerability classes across NX-OS product lines, including Nexus 3000, Nexus 7000, Nexus 9000 in ACI mode, Nexus 9000 in standalone NX-OS mode, MDS 9000 and UCS fabric interconnects. Cisco said those issues have no workarounds and require fixed software.4
Cisco’s advisories point to a familiar but difficult pattern for data center teams: the most reliable remediation is a fixed NX-OS release. Interim options depend on whether a feature can be disabled without disrupting production traffic, monitoring or troubleshooting workflows.1
For NGOAM, Cisco said Live Protect shields are available for CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501 as temporary mitigations. The company also said customers should upgrade to fixed software to remediate the vulnerabilities.1 Cisco’s release notes for Live Protect Shield LP00036 describe coverage for CVE-2026-76501 on NX-OS 10.6(3) and state that the shield is intended to bridge the gap until software updates can be scheduled.5 Separate release notes for Live Protect Shield LP00071 describe temporary mitigation for CVE-2026-76486, also tied to NX-OS 10.6(3).6
Those shields may help some teams reduce risk while waiting for a maintenance window, but they do not eliminate the need to plan software upgrades. Cisco’s Live Protect documentation for these shields points customers back to fixed software for full remediation.56
Cisco said its Product Security Incident Response Team was not aware of public announcements or malicious use of the NGOAM vulnerabilities at the time of publication.1 The company said the NGOAM flaws were found during internal security testing.1
For security teams, these advisories differ from endpoint patching because the affected systems sit in the network fabric rather than at the edge of the computing fleet. A failed or mistimed switch upgrade can affect many downstream workloads, storage paths, application tiers or tenant networks at once, especially where leaf-spine, VXLAN EVPN, SRv6 or MPLS features are used for production forwarding and diagnostics.
Endpoint patching can often be handled through rolling device groups, user reboot policies or automated management agents. Core switching updates typically require dependency mapping, redundancy checks, pre-change validation, configuration backups, image compatibility review, maintenance-window approval and rollback planning. Teams also need to consider whether disabling a feature such as NGOAM or MPLS OAM removes needed visibility or troubleshooting capability, even if it reduces the immediate attack surface.13
The practical response is a two-track process: first, identify which switches have exposed features enabled; second, schedule fixed-software upgrades or validated temporary controls in a sequence that preserves fabric availability. Cisco’s advisories and software checker should be used to determine affected releases and first fixed releases for each platform and configuration.14
For network and security operations teams, the October 7 disclosures make Nexus fabric inventory and change planning a near-term priority. The highest-risk cases are standalone NX-OS Nexus 3000 and 9000 switches with NGOAM enabled, especially where VXLAN EVPN, SRv6 or related overlay features meet Cisco’s exposure conditions.1
Tab has emerged from stealth with a personal AI assistant that users can message through iMessage or WhatsApp to shop, book, call and manage reminders. Its architecture — a phone number, computer, wallet and approval gates — shows how consumer agents are shifting from chat interfaces to delegated operators.
Google Research’s new Population Dynamics Foundation Model work suggests reusable geospatial embeddings can improve or match conventional inputs across several public-health tasks. The engineering case is strongest when the embeddings supplement existing epidemiological models, not when they are treated as a replacement for surveillance data, local validation or deployment governance.
Anthropic’s Claude Haiku 5.5 makes its small-model tier cheaper and faster for high-volume tasks, underscoring a broader shift in AI product architecture. For builders, the next margin battle is less about flagship reasoning models and more about routing repetitive agent work to low-cost models that can run at scale.
Nvidia opened preorders for RTX Spark Windows laptops as Microsoft made Microsoft Execution Containers generally available, tying new local AI hardware to operating-system controls for persistent agents. The move positions Windows as a managed runtime for local and hybrid AI work, not only a front end for cloud models.
NX-OS
Cisco’s network operating system used on Nexus data center switches and related infrastructure platforms.
NGOAM
Next Generation Operation, Administration and Maintenance, an NX-OS feature used for monitoring and diagnostics in technologies such as VXLAN and SRv6.
VXLAN EVPN
A common data center overlay architecture that extends Layer 2 and Layer 3 connectivity across an IP fabric.
Live Protect shield
A Cisco NX-OS temporary mitigation mechanism intended to reduce exposure to specific vulnerabilities until a full software upgrade can be scheduled.
Comments