Critical vulnerabilities identified in Cisco Nexus 3000 and 9000 installations can lead to remote root access and code execution!

Critical vulnerabilities in Cisco Nexus 3000 and 9000 devices can lead to remote root access and code execution! On October 7, 2026, Cisco announced three critical security vulnerabilities related to the Next Generation Operations, Administration, and Maintenance (NGOAM) function on the Cisco Nexus 3000 and Nexus 9000 series network devices. Identifiers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 were identified for these vulnerabilities. The primary CVSS severity score for all of them was rated at 9.8. If exploited, unauthenticated remote attackers could gain root-level privileges to execute arbitrary code or bypass the normal operation of the device. What is the nature of the vulnerabilities? According to Cisco information, these vulnerabilities are related to the failure to adequately inspect and properly validate IP traffic arriving when the NGOAM function is enabled. The NGOAM function is used on network devices to perform tasks such as diagnostics, connection checks, and identifying network problems. This function helps administrators monitor the state of the network infrastructure and resolve malfunctions. However, deficiencies in how this function operates in some configurations can lead to dangerous consequences. Attackers might attempt to exploit the vulnerability by sending specially crafted network packets to the vulnerable device's IP interface. According to Cisco's recommendation, such attacks do not require the user to log in or authenticate beforehand. If the attack is successful, the attacker may gain the ability to execute code with root privileges on the device's operating system. Root is the highest level of privilege in Linux and its based systems, giving extensive control over the device's critical configurations, processes, and other resources. Furthermore, exploiting these vulnerabilities can cause some processes on the device to terminate, the device to reboot, and consequently, network services to become temporarily unavailable. Therefore, these vulnerabilities pose a serious risk not only to confidentiality and integrity but also to the availability of network services. Specific aspects of the three vulnerabilities These vulnerabilities do not occur under the same conditions. Each has specific conditions for impact. To be affected by vulnerability CVE-2026-76485, the NGOAM function must be enabled on the device. This vulnerability is considered most relevant to the most permissive configuration among the three issues. CVE-2026-76486 requires the presence of SRv6 or a specific Network Virtualization Overlay configuration alongside NGOAM. When overlay configurations are used, the VXLAN EVPN network identifier must be linked to the NVE interface, and at least one VXLAN tunnel endpoint must be identified. Vulnerability CVE-2026-76501 is related to the simultaneous enablement of NGOAM and SRv6 functions. According to Cisco information, Nexus 3000 series devices do not support the SRv6 function, while only some models of the Nexus 9000 series support this capability. Therefore, it is not correct to assume that all Cisco Nexus devices are automatically affected by these three vulnerabilities. Administrators must individually check the specific model of the device, the NX-OS version, and the enabled functions. Which devices are affected? According to Cisco security advisories, the vulnerabilities are primarily relevant to Cisco Nexus 3000 and Nexus 9000 series devices running in standalone NX-OS mode. The status of the NGOAM function and some additional network capabilities is important. Cisco also stated that variants of Nexus 9000 devices running in ACI mode, the Nexus 7000 series, and MDS 9000 multilayer switch devices are not affected by these vulnerabilities. Therefore, organizations should assess their devices not just by series name, but by the device model, software version, and currently used functions. What consequences can exploiting these vulnerabilities lead to? The most serious aspect of these vulnerabilities is that they do not require prior authentication from the attacker. This significantly increases the risk for vulnerable devices located at the network edge with the relevant configuration. Successful exploitation can lead to the following situations: - Execution of arbitrary code with root privileges on the device; - Gaining high-level control over the network device; - Termination of processes on the device; - Rebooting of the device; - Temporary unavailability of network services; - Harm to the stability of the network infrastructure; - Emergence of additional risks to the organization's critical information systems and network segments. In particular, the shutdown of a switch operating in the network core can cause the interruption of many systems and services simultaneously. Therefore, these vulnerabilities should be assessed not as a simple software bug, but as a security issue directly affecting the stability of the network infrastructure. What measures has Cisco taken? Cisco has released software updates to address these vulnerabilities. The company recommends updating to the corresponding patched NX-OS version on the devices to fully remediate these vulnerabilities. Which version to update to depends on the device model and the current software version. Cisco also stated that there is no universal, permanent solution to completely eliminate these vulnerabilities. If the NGOAM function is not necessary for organizational operations, it can be considered a temporary protection measure to block the attack path. However, because this change may affect the operation of existing network functions and services, its impact on the organization's infrastructure must be assessed before implementation. Cisco also provided the Live Protect Shields mechanism for these three vulnerabilities. This protection mechanism is designed to provide temporary protection while allowing time for software updates. Cisco presents it as a temporary measure until an update can be performed, not a permanent solution. What should organization administrators focus on? Network administrators in organizations must first determine the presence of Nexus 3000 and Nexus 9000 series devices in their infrastructure, how they are operating, and whether the NGOAM function is enabled or disabled. In the next step, it is appropriate to check the following issues: - Identifying the exact model and NX-OS version of the Cisco Nexus device. - Checking if the NGOAM function is enabled. - If applicable, determining the status of the SRv6 function. - Checking the Network Virtualization Overlay and VXLAN EVPN configurations. - Identifying the patched software version recommended by Cisco. - Assessing the impact of the update on network services before deploying it to the production environment. - Implementing temporary protection measures when necessary. - Monitoring unusual network activity in network device logs and monitoring systems. Cisco recommends using the relevant NX-OS diagnostic commands to check the status of NGOAM, NVE, and SRv6 functions on the device. However, such checks should be performed with caution, taking into account the existing configuration in the production environment. Is exploitation currently active? According to Cisco information, these vulnerabilities were identified during internal security testing by the company. As of October 7, 2026, the Cisco Product Security Incident Response Team has no information that these vulnerabilities are publicly known or actively exploited. However, this situation should not be taken as a reason to ignore the risk for organizations. Especially vulnerabilities with a CVSS score of 9.8 that allow unauthenticated remote access can attract high interest from cyber attackers. Practice shows that after information about a critical vulnerability is released to the public, organizations delay their security measures, creating additional opportunities for attackers. Therefore, it is important to inventory the relevant devices, assess the impact level, and plan for updates without waiting for confirmation of active exploitation. The vulnerabilities CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 in Cisco Nexus 3000 and Nexus 9000 series devices can pose a serious threat to network infrastructure security. The fact that exploiting some of them does not require prior authentication, and successful attacks can lead to code execution with root privileges or the device becoming inoperable further increases the seriousness of this issue. Organizations should inventory the Cisco Nexus 3000 and Nexus 9000 devices in their network infrastructure, check their software versions and enabled functions, and update them to the patched NX-OS versions provided by Cisco if affected configurations are found. The most effective approach in cybersecurity is not to respond after a vulnerability has been exploited, but to assess the risk and take necessary protective measures as soon as its existence is known.