Executive Summary
CVE-2026-76465 is an input validation flaw in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS on Nexus 3000 and 9000 Series switches that lets an unauthenticated remote attacker send a crafted MPLS echo-request to trigger arbitrary code execution with root privileges or a denial of service. In OT environments where these switches sit at the aggregation and distribution layer of substation, pipeline, or plant networks, a single packet can collapse the segment that carries protection, control, and telemetry traffic.
Technical Exposure Breakdown
The vulnerable component is the MPLS echo-request handling path inside the NX-OS OAM subsystem. According to the grounding data, the device fails to properly validate an MPLS echo-request packet during processing. An attacker reaches the condition by sending that crafted packet to an IP address on an affected device. No authentication and no prior foothold are required, which is consistent with the reported CVSS score of 9.8.
The two outcomes documented are code execution at root and a denial of service condition. Root-level execution on a core switch is the worst case because it is not a loss of a single application. It is control of the forwarding plane and the management plane of the device. The DoS outcome is not a lesser concern in OT. A switch that reloads or wedges during a fault condition removes the path that relays goose messages, SCADA polls, and intertrip signals at the exact moment operators need them.
The attack surface depends on whether MPLS OAM is configured and reachable. In a flat enterprise, MPLS may be rare. In carrier-connected utility WANs, teleprotection circuits, and pipeline backbones that use MPLS for traffic engineering and pseudowires, the feature is present and the echo-request handler is live. The precondition that matters is Layer 3 reachability to an IP on the device, which in many OT designs is broader than operators assume because management VLANs and loopbacks are routed across the same fabric.
OT Impact and Compliance Risk
Physically, loss or compromise of a Nexus switch in the control path can sever communications between protection relays, RTUs, PLCs, and the control center. In a substation that means degraded or lost teleprotection. In a pipeline that means lost visibility and control over compressor and valve stations. In a plant that means a severed path between the DCS and remote I/O.
For compliance, this maps directly to several frameworks. Under NERC CIP, an unauthenticated remote root vulnerability on an Electronic Access Control or Monitoring asset or on a BES Cyber Asset drives CIP-007 patch management and CIP-005 electronic security perimeter obligations. Under IEC 62443, this is a zone and conduit failure where a conduit device can be commandeered, undermining SL assumptions across adjacent zones. For pipeline operators, TSA SD-02C requires network segmentation and prompt mitigation of known vulnerabilities on critical cyber systems. For water and wastewater, AWIA 2018 risk and resilience assessments must account for a core switch that can be taken down remotely.
Compensating Controls
Treat vendor patch availability as unknown per the grounding data and do not wait on it. Active scanning of these switches to confirm exposure is itself a hazard because probing industrial and core network devices can trigger reloads, so prefer passive discovery and configuration review over scans that touch the OAM path.
- Disable MPLS OAM where the feature is not required by the design. Confirm against a known-good configuration baseline rather than assuming default state.
- Restrict Layer 3 reachability to every switch management and loopback IP. Control plane policing and infrastructure ACLs should block MPLS echo-request traffic from any source that has no operational reason to send it.
- Enforce conduit boundaries so that only the specific peers participating in MPLS connectivity verification can reach the handler. Everything else is denied by default.
- Deploy a virtual patch at the segment boundary. A Suricata rule concept here inspects for MPLS echo-request packets arriving from untrusted zones or at unexpected device addresses and drops or alerts on them, buying time until a tested fix exists.
- Stage any eventual update in a maintenance window with a rollback plan, because NX-OS upgrades on core switches carry their own outage risk in the control path.
BreachSpider's AI analysis flags this class of unauthenticated single-packet root flaw as high priority for OT fabrics, and continuous monitoring through Intel by BreachSpider tracks patch status and exploitation signals as they develop.