On October 7, 2026, Cisco published fixes for five critical vulnerabilities in NX-OS, the operating system on its Nexus 3000 and 9000 Series data center switches running in standalone NX-OS mode. According to Cisco's advisories and the matching NVD records, each one could let an unauthenticated, remote attacker execute arbitrary code with root privileges or cause a denial of service. Each flaw can be reached only when a specific feature is turned on: NX-API, NGOAM (Next-Generation OAM) or MPLS OAM. The same day, Cisco published records for four flaws in Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem. One of them, CVE-2026-76482, carries the maximum CVSS score of 10.0.

All of these issues were found internally. BleepingComputer reports that Cisco "was unaware of public announcements or malicious exploitation" of the five NX-OS flaws when it published the advisories, and the NVD records for the License On-Prem CVEs describe them as "internally discovered vulnerabilities" found in a security review.

The NX-OS flaws, by feature

Exposure depends on how each switch is configured, so the five CVEs are grouped below by the feature that has to be enabled. Cisco's PSIRT assigned each a CVSS 3.1 base score of 9.8, according to NVD. Nexus 7000 Series switches and Nexus 9000 switches in ACI mode are not affected by any of the five, per BleepingComputer.

NGOAM: three CVEs, one advisory

Advisory cisco-sa-ngoam-rce-LWKQ4BU covers three remote code execution flaws in the Next-Generation OAM feature, which Cisco classifies under CWE-121 (stack-based buffer overflow). The advisory attributes them to "improper input validation of IP traffic when NGOAM is enabled." The preconditions differ for each:

  • CVE-2026-76485: the switch is vulnerable if NGOAM is enabled. No other feature is required.
  • CVE-2026-76486: requires NGOAM plus either SRv6 or NV Overlay. For NV Overlay, Cisco adds that an EVPN VNI must be mapped to an NVE interface with at least one peer VTEP learned.
  • CVE-2026-76501: requires NGOAM plus SRv6. The advisory notes that Nexus 3000 Series switches do not support SRv6 and that only a subset of Nexus 9000 switches do.

The advisory lists as not vulnerable the Nexus 7000 Series, Nexus 9000 Series fabric switches in ACI mode, MDS 9000 Series switches, several Firepower and Secure Firewall series, and UCS Fabric Interconnects. Cisco states that "there are no workarounds that address these vulnerabilities." It does say that disabling the feature with no feature ngoam "removes the attack vector and is a mitigation for all three vulnerabilities," with the caveat that this was tested in a lab and customers should evaluate its impact in their own environment first. The advisory says Cisco's PSIRT found the flaws "during internal security testing."

NX-API: CVE-2026-76471

The NVD record for CVE-2026-76471, which uses text supplied by Cisco's PSIRT, says the flaw in the NX-API feature "could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition." The cause is "insufficient input validation of data that is sent to the NX-API," which is reached over HTTP. BleepingComputer notes that NX-API is "a feature that is disabled by default," so only switches where an administrator turned it on are exposed.

MPLS OAM: CVE-2026-76465

The fifth NX-OS flaw is in the MPLS Operation, Administration, and Maintenance feature on Nexus 3000 and 9000 switches. NVD describes it as improper validation when the device processes an MPLS echo-request packet. According to BleepingComputer, MPLS OAM "must be explicitly activated, as it is disabled by default," and Nexus 9000 switches with Silicon One ASICs do not support the feature and are unaffected by this CVE.

License On-Prem: four flaws, one fixed release

The second set of fixes covers Cisco License On-Prem. NVD's records, from Cisco's PSIRT, describe "software hardening releases that address multiple internally discovered vulnerabilities." The four CVEs and their scores:

  • CVE-2026-76482: improper cryptographic signature verification (CWE-347), CVSS 10.0.
  • CVE-2026-76480: missing authentication for critical functions (CWE-306), CVSS 9.8.
  • CVE-2026-76483: insufficiently protected credentials (CWE-522), CVSS 9.1.
  • CVE-2026-76484: code injection (CWE-94), CVSS 8.8.

BleepingComputer reports that affected installations are vulnerable "regardless of configuration," that the fix is in version 10-202609, and that there are no workarounds. It adds that "older releases branded as Smart Software Manager will not receive a patch for these flaws," and that Cisco recommends migrating to a supported release.

What It Means for Defenders

  • Inventory feature usage first. On each Nexus 3000 and 9000 switch in standalone mode, check whether NX-API, NGOAM or MPLS OAM is enabled, and whether SRv6 or NV Overlay runs alongside NGOAM. The NGOAM advisory lists show feature commands for checking NGOAM, NV Overlay and SRv6. Switches without these features are not exposed to the five CVEs but should still be upgraded on the normal schedule.
  • Find the right release per train. The advisories point to the Cisco Software Checker for the first fixed NX-OS release on each platform and version; no single version number covers every switch.
  • Turn off unused features. Where NGOAM, NX-API or MPLS OAM isn't needed, disabling it is the mitigation Cisco and BleepingComputer describe until the upgrade lands. Test the change before rolling it across a fabric.
  • Use Live Protect as a bridge. BleepingComputer reports that Cisco offers temporary Live Protect shields for all five NX-OS flaws; the NGOAM advisory calls them "temporary mitigations to bridge the gap until software updates can be scheduled." They don't replace fixed software.
  • Plan the License On-Prem move. Schedule the upgrade to 10-202609, and treat any server still on a Smart Software Manager-branded release as a migration project rather than a patch.

Sources