EUVD-2026-94457
GHSA-74h7-6gf3-j457
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A single network-reachable MPLS echo-request with no auth or interaction yields root code execution and device reload, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.
AnalysisAI
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A crafted MPLS echo-request packet sent to an IP address on an affected device is processed without proper validation, letting an attacker execute arbitrary code as root and crash critical processes, which can force a device reload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the MPLS Operation, Administration, and Maintenance (OAM) feature to be enabled on an affected Cisco Nexus 3000 Series or Nexus 9000 Series switch running NX-OS; the attacker must be able to send an MPLS echo-request packet to an IP address on the device. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Cisco-released fixed NX-OS versions were not enumerated in the provided intelligence, so the first action is to open the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7) and map the exact fixed release for each deployed Nexus 3000/9000 build, then schedule the NX-OS upgrade in a maintenance window because the fix requires a reload - patch status should be treated as 'no vendor-released patch identified at time of analysis' from the data supplied here, and the advisory must be the source of the fix version rather than any version assumed by this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cisco NX-OS Software on Nexus 3000 Series and Nexus 9000 Series switches, determine which devices have MPLS OAM enabled and reachable, and disable MPLS OAM on any device where it is not operationally required; where MPLS OAM must remain enabled, immediately restrict reachability to trusted management networks using ACLs and filter MPLS echo-request packets at network boundaries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nx Os Software
View allUnauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execu
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 feat
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthentic
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Un
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified C
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in A
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote,
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affecte
BGP session flapping denial-of-service in Cisco NX-OS on Nexus 3000 and 9000 Series Switches exposes data-center routing
Same weakness CWE-590 – Free of Memory not on the Heap
View allShare
External POC / Exploit Code
Leaving vuln.today