External risk intelligence

Cisco Nexus MPLS OAM Remote Code Execution and Denial of Service Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76465

This vulnerability affects MPLS OAM on Cisco Nexus switches. MPLS infrastructure is typically deployed within core network provider or data center environments and is generally protected by internal network boundaries, making direct public internet exposure uncommon in standard deployments.

Denial of Service

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the MPLS OAM feature of Cisco Nexus switches that could allow an attacker to execute arbitrary code or cause a denial of service. This is due to improper validation of MPLS echo-request packets, which could lead to significant disruption if exploited.

Attackers could run unauthorized code or crash devices.
Core network devices are targeted, potentially impacting critical infrastructure.
Verify if your network uses this specific Cisco technology.

Attack Path

How an attacker could exploit the issue

An unauthenticated, remote attacker could target the MPLS OAM feature on Cisco Nexus switches by sending a specially crafted MPLS echo-request packet. If successful, this could lead to the execution of arbitrary code with root privileges or a denial of service condition on the affected device.

Entry condition: Network exposure.
Trigger point: Sending crafted MPLS echo-request.
Resulting risk: Code execution or denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the availability and integrity of network devices by allowing an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service. This is possible when an affected device processes a specially crafted MPLS echo-request packet.

Affected Cisco Nexus switches.
Sending crafted MPLS echo-request packets.
Code execution or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Cisco Nexus switches with the MPLS OAM feature enabled. Ownership likely falls to the network infrastructure or platform teams responsible for core network devices. The first step is to confirm the presence of affected devices, assess their reachability and criticality, identify the accountable owner, and then plan remediation based on risk.

Network infrastructure teams should own this.
Verify MPLS OAM reachability and criticality.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco NX-OS Software in the context of this CVE?

Cisco NX-OS is the operating system powering Nexus 3000 and 9000 Series Switches. These devices serve as high-performance building blocks for data centers and core networks. The affected component, MPLS OAM, stands for Multiprotocol Label Switching Operation, Administration, and Maintenance, a feature used by network engineers to monitor and troubleshoot the health and connectivity of paths across the network infrastructure.

How does CVE-2026-76465 create a security weakness?

This vulnerability is classified as CWE-590, which involves improper memory management or validation. In this specific case, the device fails to correctly validate incoming MPLS echo-request packets. Because the software does not properly inspect these packets, an attacker can trigger a memory-related fault, leading to arbitrary code execution with root-level system privileges or crashing the device process.

Does sending any network traffic trigger this vulnerability?

No. The vulnerability is highly specific to the MPLS OAM feature. It is triggered only when a device processes a specially crafted MPLS echo-request packet. Standard network traffic, such as typical web browsing or common application data packets, will not trigger this vulnerability. The attacker must specifically target the MPLS OAM implementation on the device.

Is my network device at risk if it is not internet-facing?

According to Halo Surface Signal, this vulnerability impacts core infrastructure typically found in data centers or provider environments. Because MPLS components are often hidden behind internal network boundaries, direct exposure to the public internet is considered uncommon. However, risk remains if an attacker has achieved a foothold within your internal network.

What steps should I take if I use these Cisco Nexus switches?

Start by identifying all Nexus 3000 and 9000 Series devices in your environment and checking if the MPLS OAM feature is currently enabled. Since this vulnerability involves critical infrastructure, involve your network administration team to assess the criticality of these switches. Plan to apply vendor-provided remediations during your next scheduled maintenance window to ensure stability and security.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.