In plain language
What this advisory means
Cisco Nexus 3000 and 9000 Series Switches have a security flaw in their MPLS OAM feature. This flaw lets an attacker, without any login, send a specially crafted message to the switch and run harmful code as if they were the device owner. This can also crash the device and cause it to stop working. Cisco has released updates to fix this issue. There's no easy workaround other than disabling the MPLS OAM feature if it's not needed.
Technical explanation
How the issue affects the environment
A critical remote code execution vulnerability exists in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software running on Cisco Nexus 3000 and 9000 Series Switches with the feature enabled. The vulnerability arises due to improper validation of MPLS echo-request packets processed by the device. An unauthenticated attacker can exploit this by sending a maliciously crafted MPLS echo-request to an IP address on the device. Exploitation can lead to arbitrary code execution with root privileges, process crashes, and device reloads causing denial of service. The MPLS OAM feature is disabled by default. Cisco has released fixed software releases to address the vulnerability. No effective workaround exists, but disabling the MPLS OAM feature mitigates exposure by removing the attack surface. Cisco also provides a Live Protect shield as a temporary mitigation. The vulnerability is tracked as CVE-2026-76465 with a CVSS 3.1 base score of 9.8 (Critical).
Operational impact
Why teams should care
Successful exploitation may allow attackers to gain root-level control over affected network switches, enabling them to execute arbitrary code, disrupt device operations by causing reloads or crashes, and potentially cause network downtime through denial of service. This can compromise network security, availability, and operational continuity, impacting business services dependent on these switches.
Immediate action
Cisco strongly recommends upgrading affected switches to fixed software releases as described in the advisory and Cisco's NX-OS Software Security Hardening Release: October 2026. Customers should verify the MPLS OAM feature is disabled if not required. Cisco also offers a Live Protect shield as a temporary mitigation. After applying fixes or mitigations, validate device and network functionality. Coordinate upgrades with Cisco TAC if necessary to ensure compatibility and support.
Affected and fixed releases
Temporary risk reduction
There are no direct workarounds to address the vulnerability. However, disabling the MPLS OAM feature on affected devices removes the attack vector and mitigates exposure. This is done using the CLI command 'no feature mpls oam' in global configuration mode. Customers should assess impact before disabling this feature as it affects MPLS OAM diagnostic capabilities.
Evidence and validation checklist
- Cisco PSIRT security advisory published October 7, 2026
- CVE identifier assigned: CVE-2026-76465
- CVSS base score 9.8 (Critical)
- Description of vulnerability mechanism involving MPLS echo-request packet validation failure
- Mitigation instructions including disabling MPLS OAM and Live Protect shield
- Fixed software releases available as per Cisco NX-OS Software Security Hardening Release: October 2026
- No known public exploitation reports
Authoritative reference
Cisco PSIRT Advisories
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.