Intel

CVE-2026-76485

NX-OS: Stack-based Buffer Overflow (CVE-2026-76485)

criticalEPSS 0.5%

Description

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

Source: NVD (NIST)cvelistv5cisco_csafCVE.org (MITRE)BSI CSAFBSI WID Portal

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

CiscoNexus
3000 Series Switches9000 Series Switches9000 Series Fabric Switches <16.0(9h)9000 Series Fabric Switches <16.1(6g)9000 Series Fabric Switches <16.2(3g)
CiscoNX-OS
9108 100G Fabric Interconnects <4.3(6.260049)9108 100G Fabric Interconnects <4.3(6.260059)9108 100G Fabric Interconnects <4.3(6j)9108 100G Fabric Interconnects <6.0(2.260080)9108 100G Fabric Interconnects <6.0(2e)MDS 9000 Series Multilayer Switches <9.4(5a)Nexus 3000 Series Switches <10.3(10)Nexus 3000 Series Switches <10.4(8)Nexus 3000 Series Switches <10.5(6)Nexus 3000 Series Switches <10.6(4)Nexus 7000 Series Switches <8.4(14)Nexus 9000 Series Fabric Switches <16.0(9h)Nexus 9000 Series Fabric Switches <16.1(6g)Nexus 9000 Series Fabric Switches <16.2(3g)Nexus 9000 Series Switches <10.3(10)Nexus 9000 Series Switches <10.4(8)Nexus 9000 Series Switches <10.5(6)Nexus 9000 Series Switches <10.6(4)UCS 6300, 6400, 6500, and 6600 Series <4.3(6.260049)UCS 6300, 6400, 6500, and 6600 Series <4.3(6.260059)UCS 6300, 6400, 6500, and 6600 Series <4.3(6j)UCS 6300, 6400, 6500, and 6600 Series <6.0(2.260080)UCS 6300, 6400, 6500, and 6600 Series <6.0(2e)UCS 6300 Series Fabric Interconnect <4.3(6.260049)UCS 6300 Series Fabric Interconnect <4.3(6j)

Metrics

XIEM Effective CVSS
9.8
Source: nvd-v3
EPSS percentile
41.6 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
critical
Priority score
92.87
Exploit maturity
no public PoC known
CVSS v3
9.8
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-07 17:17 UTC
CWE
CWE-121

Weakness classes (CWE)

  • CWE-121Variant

    Stack-based Buffer Overflow

    A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-10-08 13:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-76485","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
    • SSVC: {"id":"CVE-2026-76485","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  2. CVE Modified2026-10-08 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-76485","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical…
  3. New CVE Received2026-10-07 17:17 UTC· psirt@cisco.com
    • Description: A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • CWE: CWE-121
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/76xxx/CVE-2026-76485.json">CVE-2026-76485</a>

Linked advisories