Cisco’s CVE-2026-76485 is a remote-code-execution bug in NX-OS, the Linux-based operating system that runs Cisco Nexus data-centre switches. It matters to the teams operating Nexus 3000 and Nexus 9000 switches as standalone systems: enterprise network groups, cloud and hosting providers, service providers, and operators of large data-centre, HPC, or AI/ML fabrics.
The vulnerable component is Next Generation Operations, Administration, and Maintenance (NGOAM), NX-OS’s diagnostic feature for VXLAN overlays. VXLAN carries traffic across an IP network so workloads can share a logical network across a data-centre fabric; NGOAM supplies tools such as overlay ping, traceroute, path tracing, and loop detection. This is network infrastructure, not an application an end user consciously opens, which makes configuration inventory particularly important.
Crafted traffic reaches a stack overflow
When NGOAM is enabled, CVE-2026-76485 improperly validates IP traffic sent to an interface. Cisco describes the resulting condition as a stack-based buffer overflow (CWE-121): specially formed packets can overrun a fixed area of memory used while processing the request. The attacker needs neither credentials nor prior access to the switch, but does need network reachability to an affected IP interface and NGOAM must be enabled.
The outcome is unusually direct for a switch-management feature: arbitrary code can run with root privileges. A less controlled attempt can instead crash the affected process, reload the device, and deny service. Cisco has not published the exact malformed packet field, the vulnerable function, NX-OS source, or a patch diff, so engineers should treat third-party illustrative code as unverified rather than as exploit guidance. Cisco’s advisory assigns a 9.8 CVSS score and says the issue was found during internal testing.
Exposure is narrower than the product name
Affected systems are Nexus 3000 and 9000 Series switches running standalone NX-OS with NGOAM enabled. Nexus 9000 switches in ACI mode, along with Nexus 7000, MDS 9000, and the firewall and UCS products named in the advisory, are not affected. Cisco does not say whether NGOAM is enabled by default, so do not infer safety from a standard deployment: check each switch configuration.
Cisco disclosed two related NGOAM issues alongside this one, CVE-2026-76486 and CVE-2026-76501; the wider release also includes other Nexus fixes, among them CVE-2026-76465. That is a reason to review the full maintenance window, not a reason to assume every listed issue has the same exposure conditions.
As of October 12, 2026, Cisco says it knows of no malicious use or public announcements, no incident or named campaign has been confirmed, and no public proof of concept or exploit code has surfaced. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalogue; an independent catalogue check likewise reports no KEV match.
Upgrade after checking the exact switch release
Cisco has released corrected NX-OS software, but its public advisory does not provide a static fixed-version matrix; use Cisco Software Checker to choose the right image for the model and release train. Cisco also offers Live Protect shield LP00035 as a temporary measure, explicitly not as a replacement for upgrading. There is no workaround that keeps NGOAM available: if the feature is not needed, no feature ngoam removes this attack path.
Start by locating standalone Nexus 3000/9000 devices, confirming NGOAM state and reachable interfaces, then schedule the validated upgrade and test overlay diagnostics afterward. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs; that kind of inventory is what turns this advisory into a finite remediation list.
