Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

Sec.Cloudapps.Cisco • October 7, 2026

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper validation when an affected device is processing an MPLS echo-request packet. An attacker could exploit this vulnerability by sending a crafted MPLS echo-request to an IP address on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes, which could result in a device reload and a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 7, 2026, Security Advisories . For further documentation of improvements and fixes in Cisco NX-OS Software, see Cisco NX-OS Software Security Hardening Release: October 2026 . Security Impact Rating: Critical CVE: CVE-2026-76465

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and gain root access by sending crafted HTTP requests. CVE-2026-20316, with a CVSS score of 5.3, enables attackers to log in using static low-privileged credentials. Cisco has confirmed active exploitation of these vulnerabilities, with three distinct clusters of attacks identified, including one attributed to the Russian APT group Sandworm. Patches were released in March and July 2026, but many systems remain unpatched. Organizations are urged to apply the available updates immediately to mitigate the risks. 72 sources 88

Extracted Entities

Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)