Cisco (7 Oct) published Critical advisories for unauthenticated remote code execution / DoS via Next Generation OAM (NGOAM) on Nexus 3000 and 9000 in standalone NX-OS when NGOAM is enabled (feature preconditions differ by CVE). No workarounds; disable NGOAM if unused; Live Protect shields are temporary; upgrade to fixed NX-OS via Software Checker.
Cisco published a Critical advisory on 7 Oct (cisco-sa-ngoam-rce-LWKQ4BU, CVSS 9.8) covering CVE-2026-76485, CVE-2026-76486 and CVE-2026-76501: improper input validation in Next Generation OAM on Nexus 3000 and 9000 switches in standalone NX-OS mode can let an unauthenticated attacker run code as root or force a reload, depending on which features are enabled. There are no workarounds; Cisco advises disabling NGOAM if unused (no feature ngoam) or applying Live Protect shields until upgrading to fixed NX-OS. ACI-mode Nexus 9000 and Nexus 7000 are not affected. Soft hold: Cisco PSIRT says it is not aware of malicious use; not on CISA KEV; no invented campaigns or IoCs. Distinct from the Oct 1 Catalyst SD-WAN Manager KEV item.
Sources: Cisco Security Advisory — cisco-sa-ngoam-rce-LWKQ4BU (2026-10-07 16:00 GMT) · Soft hold: Cisco PSIRT says it is not aware of malicious use; not on CISA KEV; no invented campaigns or IoCs.