https://vulnerability.circl.lu/sightings/feed 2026-10-08T16:33:31.939374+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/3ea6d0c4-1676-4d0f-8db3-c88e8737b103/export 2026-10-08T16:33:31.960976+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3ea6d0c4-1676-4d0f-8db3-c88e8737b103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://gist.github.com/alon710/0f81717e31ca7086f341248a57c07075", "content": "# CVE-2026-76485: CVE-2026-76485: Remote Code Execution in Cisco NX-OS VXLAN OAM (NGOAM)\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-76485\n\n## Summary\nCVE-2026-76485 is a critical stack-based buffer overflow vulnerability in the VXLAN OAM (NGOAM) parsing component of Cisco NX-OS Software. The flaw enables an unauthenticated, remote attacker to execute arbitrary code with root privileges or trigger a denial of service on affected Nexus switches. This vulnerability is triggered through crafted packets sent to an IP interface. No workarounds are currently available to mitigate the vulnerability while preserving the NGOAM functionality. Cisco has published software patches to address this flaw.\n\n## TL;DR\nUnauthenticated remote code execution and denial of service vulnerability in Cisco NX-OS NGOAM feature due to improper input validation during packet parsing.\n\n## Technical Details\n\n- **CWE ID**: CWE-121\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 9.8 (Critical)\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n- **Impact**: Remote Code Execution / Denial of Service\n\n## Affected Systems\n\n- Cisco Nexus 3000 Series Switches\n- Cisco Nexus 9000 Series Switches\n- **NX-OS Software**: 9.2.x, 9.3.x, 10.3.x, 10.4.x, 10.5.x, 10.6.x (Fixed in: `Refer to Cisco Advisory`)\n\n## Mitigation\n\n- Configure Infrastructure Access Control Lists (iACLs) to drop unsolicited OAM/NGOAM packets.\n- Implement Control Plane Policing (CoPP) on vulnerable nodes.\n- Disable VXLAN OAM/NGOAM features if they are not operationally required.\n\n**Remediation Steps:**\n1. Identify vulnerable Nexus switches running affected NX-OS versions.\n2. Download the verified patch release from the official Cisco Software Central.\n3. Apply the update according to standard maintenance window protocols.\n\n## References\n\n- [Cisco Security Advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-76485)\n- [MITRE ATT&CK Search](https://attack.mitre.org/search/?search=CVE-2026-76485)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-76485) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T14:00:31.000000Z"} 2026-10-08T14:00:31+00:00 https://vulnerability.circl.lu/sighting/dc906c1d-f841-4346-9657-d53288d837b5/export 2026-10-08T16:33:31.963374+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "dc906c1d-f841-4346-9657-d53288d837b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://infosec.exchange/ap/users/117354334421158714/statuses/117403108309221215", "content": "Cisco October advisory: 18 CVEs, 7 critical, no workarounds for any of them.\nNX-OS NGOAM: CVE-2026-76485/76486/76501 \u2014 all CVSS 9.8, unauthenticated root RCE via crafted IP packets on Nexus 3000/9000. Requires NGOAM enabled (with SRv6 or NV Overlay depending on the CVE).\nCheck: show feature | include ngoamIf unused: no feature ngoam\nLicense On-Prem: CVE-2026-76482 (CVSS 10.0, signature verification bypass), CVE-2026-76480 (9.8, missing auth), CVE-2026-20328 (9.1, unauth admin password reset), CVE-2026-76454 (9.1, unauth file write). Fixed: 10-202609.\nNotable: Cisco credited AI models in vulnerability discovery. First time I've seen that in an advisory.\nNo active exploits. Patch the window.\nhttps://threataft.com/articles/cisco-october-2026-mega-roundup-ngoam-license-on-prem\n#infosec #cisco #nxos #patchnow #cve", "creation_timestamp": "2026-10-08T04:53:43.243033Z"} 2026-10-08T04:53:43.243033+00:00 https://vulnerability.circl.lu/sighting/19f27e43-8b50-4b08-88c3-5eeb51864a00/export 2026-10-08T16:33:31.963518+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "19f27e43-8b50-4b08-88c3-5eeb51864a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxdgn4adhv2l", "content": "CVE-2026-76485 - cisco nx-os software\nCisco Nexus 3000 and 9000 series switches running NX\u2011OS can be tricked into running unwanted code or rebooting if the VXLAN OAM feature is turned on. An attacker can send specially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cisco #CVE #infosec", "creation_timestamp": "2026-10-08T02:40:05.183297Z"} 2026-10-08T02:40:05.183297+00:00 https://vulnerability.circl.lu/sighting/139ff23f-aab7-4a6e-b07c-8fa8076a5c99/export 2026-10-08T16:33:31.963630+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "139ff23f-aab7-4a6e-b07c-8fa8076a5c99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxdcqmhppc2j", "content": "Cisco NX-OS NGOAM CRITICAL vuln (CVE-2026-76485): Remote unauthenticated attackers can execute code or cause DoS. Disable NGOAM if not required. Patch status pending. Details: https://radar.offseq.com/threat/a-vulnerability-in-the-vxlan-operation-administration-and-maintenance-oam-feature-of-cisc...", "creation_timestamp": "2026-10-08T01:30:28.573253Z"} 2026-10-08T01:30:28.573253+00:00 https://vulnerability.circl.lu/sighting/fcaaa606-5456-453f-9389-3c0c8ec92c18/export 2026-10-08T16:33:31.963724+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fcaaa606-5456-453f-9389-3c0c8ec92c18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117402699371323176", "content": "CVE-2026-76485: CRITICAL (CVSS 9.8) vulnerability in Cisco NX-OS NGOAM allows remote code execution or DoS via crafted packets. Disable NGOAM if unused. Awaiting official patch. Details: https://radar.offseq.com/threat/a-vulnerability-in-the-vxlan-operation-administration-and-maintenance-oam-feature-of-cisco-nx-os-41bf2bad6a99d754 #OffSeq #Cisco #CVE202676485 #Infosec", "creation_timestamp": "2026-10-08T01:30:25.773914Z"} 2026-10-08T01:30:25.773914+00:00 https://vulnerability.circl.lu/sighting/bfdd5660-341f-4bbc-81c3-31785ab5b888/export 2026-10-08T16:33:31.963822+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bfdd5660-341f-4bbc-81c3-31785ab5b888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxck45sedp27", "content": "\ud83d\udea8 CVE-2026-76485 \u2014 CVSS 9.8 CRITICAL\n\nA vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Softwa...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-76485\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-07T18:09:31.320200Z"} 2026-10-07T18:09:31.320200+00:00 https://vulnerability.circl.lu/sighting/f89df6c6-166e-4b58-b26c-720ebb9d2f9a/export 2026-10-08T16:33:31.963919+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f89df6c6-166e-4b58-b26c-720ebb9d2f9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxchif6yun2g", "content": "\ud83d\udd34 CVE-2026-76485 - Critical (9.8)\n\nA vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-76485/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-07T17:22:41.201912Z"} 2026-10-07T17:22:41.201912+00:00 https://vulnerability.circl.lu/sighting/23c91007-274b-49d0-8f13-2a9c28c1d01d/export 2026-10-08T16:33:31.964014+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "23c91007-274b-49d0-8f13-2a9c28c1d01d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-76485", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxchalbddw2p", "content": "Four critical Cisco Nexus vulnerabilities, including CVE-2026-76485 and CVE-2026-76465 (CVSS 9.8), allow root RCE on NX-OS switches. Patch now.\n\n#Cisco #Nexus #NXOS #CVE202676485 #CVE202676465 #RCE #NetworkSecurity #Vulnerability", "creation_timestamp": "2026-10-07T17:18:19.379286Z"} 2026-10-07T17:18:19.379286+00:00