Executive Summary
CVE-2026-76501 is an improper input validation flaw in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance feature (NGOAM) of Cisco NX-OS Software that allows an unauthenticated, remote attacker to send crafted packets to an IP interface and execute arbitrary code with root privileges or force a denial of service. On a device that aggregates OT traffic, a successful exploit converts a core switch into attacker-controlled infrastructure or drops it out of the network entirely, which in a plant or substation context means loss of visibility and loss of control.
Technical Exposure Breakdown
The vulnerability lives in how NGOAM parses incoming IP traffic when both the NGOAM and SRv6 features are enabled. According to the grounding data, exploitation requires only crafted packets sent to an IP interface on the affected device. There is no authentication requirement and no user interaction, which is consistent with the CVSS score of 9.8 recorded in the source.
Two outcomes are described. The first is arbitrary code execution at root, which gives an attacker full control of the control plane of the switch. The second is a denial of service, which takes the device offline or forces a reload. Both are reachable through the same packet-handling defect.
The precondition that matters is feature state. The flaw is only exposed when NGOAM and SRv6 are both enabled. SRv6 is not a default-on feature in most deployments, so the first action for any operator is to determine whether these features are actually configured on NX-OS devices in the environment rather than assuming exposure. We do not have affected version ranges or patch status in the grounding data, so operators should treat version applicability as an open question until the vendor advisory is confirmed against each specific platform and software train.
OT Impact and Compliance Risk
NX-OS platforms frequently sit in the aggregation and distribution layers of large OT networks, including utility data centers, generation sites, and pipeline control centers. A root-level compromise of one of these switches is not a single-asset event. It is a position from which an attacker can pivot across VLANs, manipulate traffic to and from PLCs, RTUs, and HMIs, and defeat segmentation that the rest of the control-system security model depends on. A denial of service against the same device removes the path that SCADA polling and protective relaying telemetry traverse.
For NERC CIP registered entities, a routable-protocol-facing device of this class is typically an in-scope Cyber Asset, and an unauthenticated remote code execution path has direct implications for CIP-007 patch management and CIP-005 electronic security perimeter obligations. Under IEC 62443, this is a failure of the system under consideration to enforce zone and conduit boundaries, and it undercuts foundational requirements around resource availability and system integrity. Pipeline operators under TSA Security Directive SD-02C should treat any management-plane or control-plane-reachable NX-OS device as a critical cyber system where network segmentation and access control measures are now the primary defense. Water and wastewater utilities with AWIA 2018 obligations should fold this into risk and resilience reassessment if NX-OS is present in their OT fabric.
Compensating Controls
Do not assume a patch is the first move. Many OT change windows are months out, and active scanning to confirm exposure can brick fragile industrial components, so inventory by configuration review, not by probing production devices.
- Confirm whether NGOAM and SRv6 are enabled. If SRv6 is not required for the design, disabling the feature removes the exposed code path entirely and is the strongest immediate control.
- Enforce infrastructure access control lists that restrict IP traffic reaching device IP interfaces to a known, minimal management and routing peer set. The attack requires reaching an IP interface, so a correctly scoped iACL blunts the external vector.
- Isolate control-plane and management interfaces into dedicated zones with explicit conduits, consistent with IEC 62443. The IT assumption that any routed reachability is acceptable does not hold in OT.
- Deploy a virtual patch at the segmentation boundary. A Suricata rule concept would alert on anomalous SRv6 and NGOAM packet structures directed at device IP interfaces, using IPv6 segment routing header inspection and rate thresholds to flag crafted probing. Run in alert mode first on a span or tap to avoid dropping legitimate routing traffic in a live control network.
- Stage vendor remediation for the next validated maintenance window once affected versions and fixed releases are published, and verify applicability per platform rather than fleet-wide.
BreachSpider Intel
BreachSpider tracks CVE-2026-76501 and related NX-OS exposure across industrial automation vendors so OT teams can monitor exploitation signals and advisory changes without scanning production control systems.