External risk intelligence

Cisco NX-OS SRv6 NGOAM Code Execution and Denial of Service Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76501

The vulnerability exists in the Segment Routing over IPv6 (SRv6) OAM feature of Cisco NX-OS. While it is network-reachable via crafted packets, this feature is typically used in core network infrastructure or specialized routing environments rather than being a public-facing web or management endpoint. Its exposure depends on specific network configuration and the deployment of SRv6.

Denial of Service

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in a Cisco networking feature related to Segment Routing over IPv6 (SRv6) could allow an attacker to execute arbitrary code with full system privileges or cause a denial of service. This issue arises from improper handling of specific types of IP traffic when the affected features are enabled.

Unvalidated IP traffic allows code execution or denial of service.
Affects specialized network routing; confirm relevance.
Understand exposure by confirming feature usage.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted packets to an internet-connected device that has the Segment Routing over IPv6 (SRv6) OAM feature enabled. This feature processes IP traffic, and if the input validation fails, the attacker may be able to execute commands with the highest level of privileges or cause the device to crash and become unavailable.

Entry condition: SRv6 OAM feature enabled on device.
Trigger point: Sending crafted IP packets to an interface.
Resulting risk: Code execution with root privileges or DoS.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in Cisco NX-OS Software's Segment Routing over IPv6 (SRv6) OAM feature could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service on an affected device when these features are enabled and the device receives crafted packets.

Affected device's integrity and availability.
Crafted packets sent to an IP interface.
Remote code execution or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can exploit a vulnerability in Cisco NX-OS Software's SRv6 OAM feature to gain root privileges or cause a denial of service. Identifying affected devices, confirming their reachability and criticality, and assigning ownership are the first steps. Network and infrastructure teams are likely responsible for addressing this issue, requiring coordination with vendor management if applicable.

Network and infrastructure teams own this.
Verify SRv6 OAM reachability and criticality.
Plan remediation or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cisco NX-OS Software and the NGOAM feature?

Cisco NX-OS is an operating system used for data center-class networking switches. Within this system, Segment Routing over IPv6 (SRv6) is a method for directing traffic through a network. The NGOAM component serves as the Operation, Administration, and Maintenance toolkit for these SRv6 paths, helping administrators monitor and verify the health of the network traffic flow.

What does CWE-121 mean for CVE-2026-76501?

CWE-121 refers to a stack-based buffer overflow. In the context of this CVE, it means the software fails to properly check the size of incoming data before copying it into memory. Because this specific feature handles complex network traffic, an attacker sending malformed data can overwrite adjacent memory, potentially leading to unauthorized command execution or system instability.

How is this vulnerability triggered?

An attacker triggers this flaw by sending specially crafted IP packets directly to an affected device interface. Importantly, the vulnerability only exists when the SRv6 and NGOAM features are explicitly enabled. If these features are disabled or not in use, the specific code path responsible for processing this traffic is not active, and the device is not susceptible.

Is my network device at risk?

Halo Surface Signal indicates that while this is reachable via network packets, it typically resides in core routing infrastructure rather than on public-facing web interfaces. You should prioritize devices where SRv6 is active, as this specialized routing configuration determines your actual exposure level regardless of the device's general placement.

How should I respond to this threat?

Begin by auditing your infrastructure to identify which devices have both SRv6 and NGOAM features enabled. Once you have a list of active devices, determine their role in your network architecture. Coordinate with your network engineering team to verify if these features are necessary for operations and monitor official guidance for available software updates.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.