CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76465
Advisory Summary
📅 October 07, 2026
🛑 Critical Alert: Cisco Nexus 3000/9000 NX-OS MPLS OAM RCE (CVE-2026-76465)
- Remote Code Execution with root privileges
- DoS via process crashes, potentially leading to device reload
- Full control of the device OS
- Lateral movement into the data center fabric
- Persistent compromise (e.g., tampering with control-plane behavior)
- The device must be reachable via an IP address that processes MPLS OAM echo requests
- The attacker must be able to deliver crafted MPLS echo-request packets to the affected component
- Patch now: Cisco has released software updates that address the vulnerability.
- No workaround available: Cisco states there are no workarounds to mitigate this risk.
✅ Recommended immediate actions
1. Identify exposure: Determine NX-OS versions in your Nexus 3000/9000 fleet and confirm whether they fall within the affected ranges.
2. Apply the fixed release: Prioritize patching for internet-facing or transit/edge switches first.
3. Hunt for indicators: Look for abnormal MPLS echo-request traffic patterns or control-plane instability/reloads around the time windows of interest.
4. Reduce reachability (temporary containment): While no workaround exists, limiting network paths that can send MPLS OAM packets can reduce practical exposure until patches are applied.
- CVE: CVE-2026-76465
- Impact rating: Critical
- Affected feature: MPLS OAM processing of MPLS echo-request packets
- Outcome: RCE (root) + DoS/reload
-OS -2026-76465
Reference: Vendor Advisory