Executive Summary

CVE-2026-76486 is an improper input validation flaw in the VXLAN Operation, Administration, and Maintenance feature (NGOAM) of Cisco NX-OS Software that lets an unauthenticated, remote attacker send crafted IP packets to an interface and execute arbitrary code with root privileges or crash the device. In a data center or substation leaf-spine fabric carrying process traffic, loss or compromise of a switch at this layer collapses the transport path for every VLAN and VXLAN segment riding on it.

Technical Exposure Breakdown

The defect lives in how NX-OS parses incoming IP traffic when the NGOAM feature is enabled. NGOAM exists to provide loopback and path trace diagnostics across a VXLAN overlay, so the component by design listens for and processes OAM-related packets on IP interfaces. Per the grounding data, the flaw is improper input validation of that IP traffic, which is the classic precondition for memory corruption leading to code execution.

The attack vector is network reachable and requires no authentication and no prior foothold. An attacker sends crafted packets to an IP interface on an affected device. A successful exploit yields code execution at root, which is total control of the switch control plane, or a denial of service that drops the device. The carried CVSS score is 9.8, consistent with an unauthenticated remote code execution primitive with no user interaction.

Two conditions govern real exposure. First, the NGOAM feature must be enabled. Many fabrics deploy VXLAN EVPN without turning on NGOAM diagnostics, so the first triage question for any operator is whether the feature is active on the running configuration. Second, the attacker needs IP reachability to an interface on the device. In a properly segmented plant network that reachability should be constrained, but flat OT fabrics and shared management networks frequently violate that assumption.

We do not have affected version lists or patch availability in the grounding data, so treat every NX-OS switch running VXLAN with NGOAM as in scope until the vendor advisory confirms otherwise. Do not infer that a given train or maintenance release is safe.

OT Impact and Compliance Risk

NX-OS switches sit under the process and control traffic of many modern substations, generation plants, and manufacturing cells that have moved to VXLAN EVPN for east-west segmentation. Root on one of these devices means an attacker can rewrite forwarding, mirror or inject traffic between zones that were supposed to be isolated, or simply drop the device and sever the fabric. A DoS at this layer is not a nuisance. It can blind SCADA polling, interrupt protection relay communications, and stall PLC-to-HMI traffic.

From a compliance standpoint, an unauthenticated root path through a network device inside an electronic security perimeter is a direct challenge to NERC CIP-005 and CIP-007 for registered entities, since the switch becomes a Cyber Asset that can no longer be trusted to enforce the perimeter it helps define. For IEC 62443 environments, this breaks the zone and conduit model, because a compromised conduit device collapses the separation between zones. Pipeline operators under TSA SD-02C should map this against their network segmentation and critical cyber system inventory requirements, since VXLAN fabrics often span the boundary the directive expects to be controlled. Water and wastewater utilities subject to AWIA 2018 risk assessments should account for the same transport-layer single point of failure.

Compensating Controls

If NGOAM is not required, disable the feature. That removes the vulnerable listener and is the strongest available mitigation short of a confirmed fix. Audit running configurations across the fleet rather than trusting templates.

Restrict IP reachability to switch interfaces using control plane policing and management plane protection, and enforce infrastructure ACLs that deny OAM and diagnostic traffic from untrusted segments. The device should only accept this traffic from a defined diagnostic source set.

For virtual patching, place an inline IPS at zone conduits and build a Suricata rule concept that alerts on anomalous or malformed NGOAM and VXLAN OAM packets directed at infrastructure IP addresses, keyed on unexpected source zones and oversized or malformed OAM payloads. Do not rely on active scanning to validate exposure. Credentialed configuration review and passive traffic inspection are safer than probing live switches, since aggressive scans against control plane features can themselves induce the DoS condition you are trying to avoid.

BreachSpider Intel

BreachSpider tracks CVE-2026-76486 and related NX-OS fabric exposures across more than 384,000 CVEs and 10,000 CVEs linked to industrial automation vendors, with continuous monitoring available for OT network device fleets.