OTPulse

Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

Plan PatchCVSS 9.8cisco-sa-moam-rce-uBTzYV7Oct 7, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 and 9000 Series Switches allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service. The vulnerability stems from improper validation of MPLS echo-request packets. An attacker can exploit this by sending a crafted MPLS echo-request to an IP address on an affected device, potentially resulting in arbitrary code execution with root privileges or process crashes leading to device reload.

What this means
What could happen
An attacker could remotely execute commands on your network switch with root privileges, giving them complete control over traffic routing and network connectivity. This could halt communications between your facilities or allow an attacker to intercept and modify operational data flowing through the network.
Who's at risk
Network operators managing Cisco Nexus 3000 or 9000 Series Switches in production environments should prioritize this vulnerability. These switches are critical to data center, enterprise, and utility network operations. Any device running NX-OS software with MPLS OAM enabled is at immediate risk.
How it could be exploited
An attacker sends a crafted MPLS echo-request packet to an affected Nexus switch from any network that can reach the switch's IP address. The switch does not properly validate the packet, allowing the attacker to trigger arbitrary code execution with root privileges or crash the device, causing a network outage.
Prerequisites
  • Network-layer reachability to the affected switch's IP address
  • MPLS OAM feature enabled on the switch or default configuration allowing MPLS echo-request processing
remotely exploitableno authentication requiredlow complexityhigh EPSS score (>10%)affects network infrastructure critical to operations
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Nexus 3000 Series SwitchesAll versionsFix available
Nexus 9000 Series SwitchesAll versionsFix available
Remediation & Mitigation
0/4
Do now
0/3
HOTFIXContact Cisco support or consult the published security advisory for the specific NX-OS firmware version that patches this vulnerability for your Nexus model, then plan a maintenance window to apply the update.
WORKAROUNDDisable MPLS OAM feature if not required for your network operations to eliminate the attack vector.
HARDENINGRestrict network access to your Nexus switches by configuring firewall rules or network ACLs to allow only trusted management and peer devices to send MPLS packets to the switch.
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate Nexus switches from untrusted network segments and limit MPLS traffic sources.
View full vendor advisory
API: /api/v1/advisories/8b99fe81-6586-40e4-96fd-4ea008a83855

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.