Critical Cisco NX-OS Vulnerabilities Allow Remote Attackers to Gain Root Access

Cisco published an advisory for three critical NX-OS NGOAM vulnerabilities (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) allowing unauthenticated remote attackers to execute code as root or cause device crashes/DoS on Nexus 3000/9000 switches depending on configuration. The flaws are stack-based buffer overflows triggered by specially crafted packets when NGOAM (and in some cases SRv6 or specific VXLAN overlay conditions) is enabled; Cisco provides detection commands, recommends upgrading to fixed releases or disabling NGOAM as a mitigation, and reported no known exploitation at publication.