Cisco patches Nexus MPLS flaw that permits root-level code execution

An MPLS diagnostic packet crafted for a vulnerable Cisco Nexus switch can execute root-privileged code or crash a process and reload the device. Cisco’s October 7 advisory identifies CVE-2026-76465 in the MPLS Operation, Administration, and Maintenance (OAM) feature. Vulnerable Nexus 3000 devices and Nexus 9000 devices in standalone NX-OS mode are exposed when MPLS OAM is enabled.

The feature is disabled by default. Cisco says Nexus 9000 models with a Silicon One ASIC cannot enable it, and Nexus 9000 switches in ACI mode are outside the affected set. That narrows the first job for a network operator: identify which switches actually run MPLS OAM before planning changes to their diagnostic traffic.

The echo-request reaches NX-OS

MPLS OAM provides MPLS ping and traceroute for checking data-plane failures. Cisco attributes the flaw to improper validation while an affected switch processes an MPLS echo-request. A remote, unauthenticated attacker can send a crafted echo-request to an IP address on the switch; the Cisco-assigned CVE record also classifies the bug as CWE-590, free of memory not on the heap. Cisco says exploitation could run code as root. A process crash may reload the switch and interrupt traffic. The record gives the flaw a CVSS 9.8 base score.

This is a separate feature and CVE from the NGOAM packet-processing flaws covered earlier this week. An NGOAM configuration check will not tell you whether MPLS OAM is enabled. The packet path here is an IP address on an affected switch, so a management-only access review misses other reachable switch interfaces.

Feature state determines exposure

On each candidate switch, use the NX-OS command show feature | include mpls_oam. Cisco’s enabled example returns mpls_oam 1 enabled. Record the device model, operating mode, installed release and feature state together. Use Cisco’s Software Checker linked in the advisory with that platform and release to determine its affected status and first fixed release. For a Silicon One Nexus 9000 or an ACI-mode switch, record the exclusion rather than treating the whole 9000 series alike.

Cisco uncovered the flaw in its own tests. Its PSIRT reports no known public announcements or malicious use. For response priority, pair the feature result with the IP paths into each switch interface. A disabled feature removes this packet-processing entry point; an enabled feature on an affected release calls for a software change or a temporary mitigation.

Disable MPLS OAM or upgrade

Cisco has issued fixed NX-OS software. Check each switch’s platform and installed release in the Software Checker linked from Cisco’s advisory; upgrade affected devices to the first fixed build returned for that model. If MPLS OAM diagnostics are unnecessary, evaluate their operational impact, then disable the feature in NX-OS global configuration mode with no feature mpls oam. Cisco tested that mitigation and says it removes the attack vector. Where diagnostics must stay enabled until maintenance, Cisco offers a Live Protect shield for CVE-2026-76465 as a temporary bridge to the software upgrade. Cisco says, “There are no workarounds that address this vulnerability.”

Verify feature state after disabling it: rerun show feature | include mpls_oam and expect disabled. Confirm the installed release after upgrading against the first fixed build Cisco’s checker returns for the switch. Reachable switch IP interfaces remain relevant while the feature is enabled on a vulnerable build, even when management access is restricted.