Cisco Patches Critical MPLS OAM RCE and NGOAM Flaws in Nexus Switches
Cisco has released updates for critical remote code execution vulnerabilities in Nexus 3000 and 9000 series switches affecting MPLS and NGOAM features.
Key points
- Unauthenticated attackers can execute arbitrary code with root privileges via crafted MPLS echo-request packets.
- Multiple flaws in Next Generation OAM (NGOAM) allow remote code execution or denial of service through improper input validation.
- A medium-severity vulnerability in Nexus 9000 ACI mode allows bypass of endpoint group contracts using DHCP ports.
Cisco has published security advisories and released software updates to address three vulnerabilities in its Nexus 3000 and 9000 Series Switches running NX-OS Software. The most severe issue, rated Critical, allows unauthenticated remote attackers to execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to affected devices.
At a glance
- Publisher
- Cisco PSIRT
- CVEs
- See advisory
The critical vulnerability, tracked as CVE-2026-76465, resides in the Multiprotocol Label Switching (MPLS) Operation, Administration, and Maintenance (OAM) feature. Cisco stated that the flaw results from improper validation when the device processes an MPLS echo-request packet. An attacker can exploit this by sending a crafted MPLS echo-request to an IP address on the switch. Successful exploitation enables the attacker to run arbitrary code with root privileges. Additionally, the exploit can trigger process crashes that lead to a device reload and a denial of service condition. Cisco confirmed that there are no workarounds for this issue.
Context and Background
In addition to the MPLS flaw, Cisco identified multiple vulnerabilities in the Next Generation OAM (NGOAM) feature, collectively tracked under CVE-2026-76465 according to the advisory structure, though the source material lists a separate advisory URL for NGOAM. The NGOAM vulnerabilities are also rated Critical. These flaws stem from improper input validation of IP traffic when NGOAM is enabled.
Attackers can exploit these issues by sending crafted packets to an IP interface on the affected device. Like the MPLS vulnerability, successful exploitation of NGOAM flaws allows for arbitrary code execution with root privileges and can cause process crashes resulting in device reloads and denial of service. Feature requirements for these vulnerabilities vary, and administrators should consult the specific advisory for details.
A third vulnerability, rated Medium, affects Cisco Nexus 9000 Series Fabric Switches operating in Application Centric Infrastructure (ACI) Mode. Tracked as CVE-2026-20038, this flaw exists in the endpoint group (EPG) contract functionality due to improper control mechanisms. An unauthenticated, remote attacker can bypass configured EPG contracts by sending IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic through the affected device. Cisco noted that there are no workarounds for this contract bypass vulnerability.
Who is affected
The vulnerabilities impact Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches running NX-OS Software. The MPLS OAM and NGOAM remote code execution flaws affect both the 3000 and 9000 series. The endpoint group contract bypass vulnerability specifically affects Nexus 9000 Series Fabric Switches configured in ACI Mode. Cisco stated that feature requirements vary for the NGOAM vulnerabilities, indicating that only devices with specific configurations are at risk.
What should you do?
Cisco has released software updates that address all three vulnerabilities. The company stated that there are no workarounds available for any of these issues. Administrators should apply the latest software updates immediately. For further documentation on improvements and fixes, Cisco directs users to the Cisco NX-OS Software Security Hardening Release: October 2026. The advisories are part of a group published on October 7, 2026.
What to do and how to stay safe: Cisco
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of the MPLS OAM vulnerability in Nexus switches?
Cisco rates the MPLS OAM remote code execution vulnerability (CVE-2026-76465) as Critical.
Are there any workarounds for these Nexus switch vulnerabilities?
No, Cisco stated that there are no workarounds that address any of these vulnerabilities.
How can an attacker exploit the ACI EPG contract bypass flaw?
An attacker can send IPv4 or IPv6 packets using UDP source and destination ports assigned to DHCP traffic through the affected device.
