EUVD-2026-94474
GHSA-vxhc-whj8-6j78
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote crafted packets to an IP interface with no auth or interaction (AV:N/AC:L/PR:N/UI:N); root-level code execution plus reload DoS gives C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device.
This vulnerability is due to improper input validation of IP traffic when the NGOAM and SRv6 features are enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
AnalysisAI
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 features are both enabled, due to a stack-based buffer overflow (CWE-121) from improper input validation of IP traffic. An unauthenticated, remote attacker with network reachability to an IP interface can send crafted packets to execute arbitrary code with root privileges or cause a reload, resulting in a DoS condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that BOTH the NGOAM (SRv6 OAM) feature AND the SRv6 feature are explicitly enabled on the device - this is a non-default configuration and is the single largest limiting factor on real-world exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the available data; consult the Cisco advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU for fixed software releases and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco NX-OS/Nexus device and determine which ones currently run both SRv6 and NGOAM enabled (for example via 'show running-config | include srv6|ngoam' and 'show srv6 oam' style checks); where those features are not actively required for a documented business use case, disable NGOAM and SRv6 immediately and save the configuration, and for any device that must keep them enabled, restrict IP reachability to the affected interfaces with infrastructure ACLs so that only trusted management or transport subnets can send traffic to them, while alerting the network operations and security teams and opening a case with Cisco TAC to confirm current guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nx Os Software
View allUnauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execu
Unauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthentic
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Un
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified C
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in A
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote,
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affecte
BGP session flapping denial-of-service in Cisco NX-OS on Nexus 3000 and 9000 Series Switches exposes data-center routing
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today