CVE-2026-76465 in NX-OS Software
Summary
by MITRE • 10/07/2026
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The Cisco NX-OS software, utilized within the Nexus 3000 and Nexus 9000 series switches, contains a critical security flaw within its Multiprotocol Label Switching Operation, Administration, and Maintenance feature set. This vulnerability stems from an insufficient validation mechanism when processing incoming MPLS echo-request packets. The core technical deficiency lies in the failure of the affected device to properly sanitize or verify specific fields within these control plane messages before they are processed by the underlying system routines. Because this component is responsible for maintaining network connectivity and diagnosing path integrity, it must handle a high volume of traffic from various sources. When an attacker crafts a malicious MPLS echo-request packet with specifically designed malformed data structures, the software fails to detect the anomaly during its initial parsing phase. This lack of rigorous input validation allows the crafted payload to bypass standard security checks and interact directly with memory management subsystems in an unintended manner.
The operational impact of this vulnerability is severe due to the potential for remote code execution with root privileges. An unauthenticated, remote attacker can exploit this flaw by simply sending a specially constructed MPLS echo-request packet to any IP address configured on the affected switch interface. Upon successful exploitation, the malicious payload executes arbitrary commands within the context of the operating system's highest privilege level. This grants the adversary complete control over the network device, enabling them to modify routing tables, intercept traffic, or pivot into other segments of the enterprise network. Furthermore, even if code execution is not achieved, the malformed input can trigger process crashes within the NX-OS software stack. These crashes often lead to a system reload, resulting in a denial of service condition that disrupts all network services passing through the compromised switch for the duration of the reboot and subsequent configuration restoration.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the root cause is the failure to verify the integrity and structure of incoming data packets before processing them. The attack vector falls under ATT&CK technique T1498 Network Denial of Service if exploited for disruption or T1053 Scheduled Task/Job if used to maintain persistence after gaining initial access through code execution. Given that the exploit requires no authentication, it is classified as an unauthenticated remote vulnerability, significantly increasing its risk profile in public-facing or poorly segmented network environments. The ability to execute arbitrary code with root privileges transforms a simple input validation error into a critical system compromise, allowing attackers to fully subvert the security boundaries of the infrastructure device itself.
Mitigation strategies must prioritize immediate patching and configuration hardening. Cisco has released software updates that address this specific flaw by implementing stricter validation logic for MPLS echo-request packets within the NX-OS codebase. Administrators should apply these patches as soon as possible to close the attack surface. In environments where immediate patching is not feasible, network segmentation can help mitigate risk by restricting access to management interfaces and disabling unnecessary OAM features if they are not actively required for operations. Additionally, deploying intrusion prevention systems that can detect and block malformed MPLS packets at the perimeter provides an additional layer of defense against exploitation attempts while permanent fixes are deployed across the infrastructure.