EUVD-2026-94467
GHSA-cpwq-8jv6-8vg5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated crafted-packet attack to an IP interface (AV:N/AC:L/PR:N/UI:N) yielding root RCE and reload DoS (C/I/A:H); NGOAM-enabled requirement is a config precondition, not a base-metric factor.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device.
This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.
AnalysisAI
Unauthenticated remote attackers with IP reachability to an affected Cisco NX-OS device can achieve arbitrary code execution with root privileges - or force a process crash and device reload - by sending crafted packets to the VXLAN Operation, Administration, and Maintenance (NGOAM) feature. The flaw is a stack-based buffer overflow (CWE-121) triggered by insufficient validation of IP traffic, and it is fully unauthenticated and requires no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N), yielding a 9.8 base score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the NGOAM (VXLAN Operation, Administration, and Maintenance) feature be explicitly enabled on the affected Cisco NX-OS device - this is the exact gating condition and NGOAM is not part of a default base configuration, so only VXLAN deployments that have turned on NGOAM are vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk inflation case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fixed NX-OS release is specified in the supplied intelligence, so patch status is not confirmed from available data; the authoritative fix matrix and any interim guidance are published in Cisco Security Advisory cisco-sa-ngoam-rce-LWKQ4BU (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU) - consult it and upgrade to the listed fixed release for the affected train. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Cisco NX-OS device in the estate and determine which ones have NGOAM (VXLAN OAM) enabled; the feature is not in the default base image, so confirm via running configuration rather than assumption. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Nx Os Software
View allUnauthenticated remote code execution in the NX-API feature of Cisco NX-OS Software lets a remote attacker who can reach
Remote code execution and denial of service in Cisco NX-OS Software are possible when the SRv6 OAM (NGOAM) and SRv6 feat
Remote code execution with root privileges and denial-of-service in Cisco NX-OS Software can be triggered by unauthentic
Unauthenticated, remote code execution with root privileges and denial of service in Cisco NX-OS Software on Nexus 3000
Improper access control in Cisco NX-OS - including NX-OS running in ACI mode and the NX-OS component of managed Cisco Un
Out-of-bounds write defects in Cisco NX-OS Software - spanning standalone NX-OS switches, NX-OS System Software running
Remote code execution in the Silicon One integration of Cisco Nexus 9000 Series Switches (Cisco NX-OS Software) lets an
Improper neutralization of input in Cisco NX-OS software, NX-OS System Software running in ACI mode, and Cisco Unified C
Remotely triggerable denial-of-service conditions in Cisco NX-OS Software - including NX-OS System Software running in A
Out-of-bounds read issues in Cisco NX-OS, NX-OS in ACI mode, and managed Cisco UCS software can be triggered by remote,
Unauthenticated, network-reachable input-validation flaws in Cisco NX-OS Software command processing can disrupt affecte
BGP session flapping denial-of-service in Cisco NX-OS on Nexus 3000 and 9000 Series Switches exposes data-center routing
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today