Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

Description

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.

Scores

EPSS (exploitation in 30 days)

0.46% · top 60% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-590: Free of Memory not on the Heap (opens in a new tab)All about CWE-590 and its CVEs

Affected products

• Cisco · Cisco NX-OS Software

  • affected 9.3(2)
  • affected 9.3(1)
  • affected 9.3(1z)
  • affected 9.3(3)
  • affected 9.3(4)
  • affected 9.3(5)
  • affected 9.3(6)
  • affected 9.3(5w)
  • affected 9.3(7)
  • affected 9.3(7k)
  • affected 9.3(7a)
  • affected 9.3(8)
  • affected 9.3(9)
  • affected 9.3(10)
  • affected 10.3(1)
  • affected 10.3(2)
  • affected 9.3(11)
  • affected 10.3(3)
  • affected 9.3(12)
  • affected 10.4(1)
  • affected 10.3(99w)
  • affected 10.3(3w)
  • affected 10.3(99x)
  • affected 10.3(3o)
  • affected 10.3(4)
  • affected 10.3(3p)
  • affected 10.3(4a)
  • affected 10.4(2)
  • affected 10.3(3q)
  • affected 9.3(13)
  • affected 10.3(5)
  • affected 10.4(3)
  • affected 10.3(3x)
  • affected 10.3(4g)
  • affected 10.5(1)
  • affected 10.3(3r)
  • affected 10.3(6)
  • affected 9.3(14)
  • affected 10.4(4)
  • affected 10.3(4h)
  • and 26 more

What to do

Exploitation: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References (1)

• cisco-sa-moam-rce-uBTzYV7 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-76465](https://trackcve.app/badge/CVE-2026-76465.svg)](https://trackcve.app/cve/CVE-2026-76465)

Record last updated 8 Oct 2026, 03:55 UTC.