OTPulse

Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

Plan PatchCVSS 9.8cisco-sa-ngoam-rce-LWKQ4BUOct 7, 2026
CiscoTransportation
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Multiple vulnerabilities in the Next Generation OAM (NGOAM) feature of Cisco NX-OS Software on Nexus 3000 and 9000 Series Switches allow an unauthenticated remote attacker to execute arbitrary code with root privileges or cause denial of service. The vulnerabilities stem from improper input validation of IP traffic when NGOAM is enabled. An attacker could send crafted packets to an affected device's IP interface to execute code or crash the device, forcing a reload.

What this means
What could happen
An attacker could send crafted network packets to run commands with root privileges on your Nexus switches, potentially taking control of your network infrastructure, or cause the switches to crash and stop routing traffic.
Who's at risk
Network operators responsible for Cisco Nexus 3000 and 9000 Series switches used in data center, transportation, and core network environments. This affects anyone relying on these switches for network routing and traffic forwarding.
How it could be exploited
An attacker sends specially crafted IP packets to the NGOAM feature on an affected Nexus switch from the network. If NGOAM is enabled, the improper input validation allows the attacker to execute arbitrary code with root privileges or crash the device.
Prerequisites
  • Network access to an affected Nexus switch IP interface
  • NGOAM (Next Generation OAM) feature enabled on the target switch
  • No authentication required
remotely exploitableno authentication requiredlow complexitycritical CVSS score (9.8)affects network infrastructurecan cause denial of service
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (2)
2 with fix
ProductAffected VersionsFix Status
Nexus 3000 Series SwitchesAll versionsFix available
Nexus 9000 Series SwitchesAll versionsFix available
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDDisable NGOAM (Next Generation OAM) feature if not in use
HARDENINGRestrict network access to Nexus switch management and data plane interfaces using firewall rules or access control lists to limit exposure to untrusted networks
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Cisco NX-OS Software to the fixed version for your Nexus 3000 or 9000 Series Switch
View full vendor advisory
API: /api/v1/advisories/fe9e3893-b0a3-4ad5-b239-93faabc0cfe3

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities | CVSS 9.8 - OTPulse