CVE-2026-76501

Executive Summary

CVE-2026-76501 is a critical input validation vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, referred to as NGOAM. An unauthenticated, remote attacker can send crafted IP packets to an affected device's IP interface when both NGOAM and SRv6 features are enabled, potentially achieving arbitrary code execution with root privileges or causing a denial-of-service (DoS) condition via process crashes and device reload. With a CVSS score of 9.8, this vulnerability poses an extreme risk to any organization running affected Cisco NX-OS devices with SRv6 and NGOAM features enabled in their network infrastructure.

Technical Analysis

CVE-2026-76501 is classified as CWE-121 (Stack-based Buffer Overflow), which indicates that the vulnerability stems from improper input validation of IP traffic when the NGOAM and SRv6 features are enabled on Cisco NX-OS devices. The core mechanism involves the device's handling of SRv6 OAM packets — specifically, the processing of IP traffic related to the NGOAM (SRv6 OAM) functionality.

The attack surface is the network-facing IP interface of an affected Cisco NX-OS device. Because the vulnerability requires no authentication (PR:N) and no user interaction (UI:N), any host capable of reaching an IP interface on the device can potentially trigger the flaw. The attack vector is network-based (AV:N), and the attack complexity is low (AC:L), meaning no specialized conditions or race conditions are required for successful exploitation.

The fundamental issue is improper input validation. When the NGOAM and SRv6 features are enabled, the device processes incoming IP traffic through the NGOAM processing path. Crafted packets that violate expected input constraints can trigger a stack-based buffer overflow (CWE-121). In the context of CWE-121, this typically means that data written to a fixed-length stack buffer exceeds its bounds, potentially overwriting adjacent memory — including control structures such as return addresses or function pointers. Because the affected code executes with root privileges within the device's operating system, successful exploitation can result in arbitrary code execution at the highest privilege level.

It is important to note that the exact parsing routines, function names, and code paths are not disclosed in the available NVD description. The vulnerability class — stack-based buffer overflow due to improper input validation of network traffic — is well understood, but specific implementation details remain undisclosed. This lack of technical specificity means defenders must rely on the vendor's advisory and network-level detection rather than signature-based host detection of specific malicious payloads.

The dual impact — arbitrary code execution or DoS — suggests that the crafted packet may either achieve controlled memory corruption (leading to code execution) or cause an uncontrolled crash (leading to process restart and device reload). The DoS condition arises from process crashes that trigger a reload, disrupting all network services provided by the device.

Exploitation Scenarios

No public proof-of-concept (PoC) or exploit code is available for CVE-2026-76501. The attack chain described below is inferred from the vulnerability class and the information provided in the NVD description. No specific function names, API endpoints, or packet structures are fabricated here.

1) Reconnaissance and target identification: An attacker first identifies reachable Cisco NX-OS devices that have both the SRv6 and NGOAM features enabled. This can be accomplished through network scanning (e.g., identifying Cisco devices via SNMP banners, SSH banners, or HTTP management interfaces) and by probing for SRv6-related IPv6 traffic handling. Devices that expose IP interfaces and run SRv6 with OAM enabled are potential targets. The attacker needs only network reachability to an IP interface on the device — no credentials are required.

2) Triggering the flaw (improper input validation leading to stack buffer overflow): The attacker crafts IP packets destined to the device's IP interface. Because the vulnerability is due to improper input validation of IP traffic when NGOAM and SRv6 are enabled, the attacker sends these crafted packets to the vulnerable interface. The packets are designed to exploit the lack of proper bounds checking or validation in the NGOAM processing path, causing a stack-based buffer overflow (CWE-121). The specific packet structure required to trigger the overflow is not disclosed in available data; however, at the vulnerability-class level, this involves supplying input that exceeds the expected size or violates expected format constraints handled by the NGOAM packet parser.

3) Payload and execution method: No public exploit exists, so the exact payload delivery mechanism is unknown. At the vulnerability-class level, a stack-based buffer overflow can be exploited to overwrite control data on the stack, such as a return address or function pointer. If the attacker can control the overwritten value, they may redirect execution to attacker-controlled code or existing code gadgets (e.g., ROP). Because the affected process runs with root privileges, successful code execution grants the attacker root-level control over the device's operating system. Alternatively, if the overflow is not controlled, the process may crash, leading to a reload and DoS condition — this is the simpler outcome and requires no sophisticated payload.

4) Post-exploitation impact: If arbitrary code execution is achieved, the attacker gains root privileges on the affected device. This allows full control over the device's configuration, traffic forwarding, and potentially the ability to pivot into the network infrastructure. The attacker could modify routing tables, intercept or redirect traffic, disable security features, or use the device as a foothold for further attacks. If the DoS condition is triggered instead, the device reloads, causing a temporary loss of all network services provided by that device — a significant availability impact. The CVSS vector indicates high confidentiality, integrity, and availability impact (C:H/I:H/A:H), reflecting the severity of both outcomes.

Impact Assessment

The CVSS v3.1 base score of 9.8 (Critical) reflects the following subscores: Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: None (PR:N), User Interaction: None (UI:N), Scope: Unchanged (S:U), Confidentiality: High (C:H), Integrity: High (I:H), Availability: High (A:H).

The business impact is severe. Affected systems are Cisco NX-OS devices configured with both the SRv6 and NGOAM features enabled. These are typically high-capacity switches and routers deployed in data center, service provider, and large enterprise network cores. A successful exploit can lead to complete compromise of the device with root privileges, allowing an attacker to manipulate network traffic, exfiltrate data traversing the device, or disrupt critical network services. The DoS condition can cause device reloads, leading to extended network outages and potential cascading failures across dependent systems.

The blast radius depends on the role of the affected device in the network topology. A core router or data center switch compromise can affect thousands of downstream users and services. Because the vulnerability is unauthenticated and remotely exploitable, any internet-facing or internally reachable device with the vulnerable features enabled is at risk. The lack of a CISA KEV listing and absence of public exploit code suggest that exploitation may not yet be widespread, but the critical severity and low attack complexity make it an attractive target for both sophisticated APT actors and opportunistic attackers.

Detection Guidance

Detection for CVE-2026-76501 must focus on network-level monitoring of SRv6 OAM traffic and host-level monitoring of Cisco NX-OS device behavior. Because no public exploit exists, detection rules should target anomalies and potential exploitation patterns rather than known signatures.

Sigma Rule

title: Potential Cisco NX-OS NGOAM SRv6 Exploitation Attempt
id: 8f4b2c1e-9a3d-4f7e-b2c8-1d5e6f7a8b9c
status: experimental
description: Detects potential exploitation of CVE-2026-76501 via crafted IP traffic targeting SRv6 NGOAM on Cisco NX-OS
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76501
author: Valters IT Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-76501
logsource:
  category: network_connection
  product: cisco
  service: nx-os
detection:
  selection:
    EventID:
      - 'NETWORK_ANOMALY'
    DestinationPort:
      - 0
    Protocol:
      - 'ipv6'
    Keywords:
      - 'NGOAM'
      - 'SRv6'
      - 'OAM'
      - 'buffer overflow'
      - 'stack corruption'
  condition: selection
falsepositives:
  - Legitimate SRv6 OAM traffic
  - Network maintenance operations
level: critical

YARA Rule

rule CVE_2026_76501_Cisco_NXOS_NGOAM_Exploit
{
    meta:
        description = "Detects potential exploitation of CVE-2026-76501 in Cisco NX-OS SRv6 NGOAM"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76501"
        severity = "critical"

    strings:
        $srv6_oam = { 00 00 00 00 00 00 00 00 }  // Placeholder for SRv6 OAM header pattern
        $ngoam_keyword = "NGOAM" ascii nocase
        $sr_keyword = "SRv6" ascii nocase
        $oam_keyword = "OAM" ascii nocase
        $crash_keyword = "reload" ascii nocase
        $stack_overflow = "stack" ascii nocase

    condition:
        any of ($ngoam_keyword, $sr_keyword, $oam_keyword) and
        any of ($crash_keyword, $stack_overflow)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-76501 Cisco NX-OS SRv6 NGOAM Exploitation Attempt"; flow:to_server; content:"|00 00|"; depth:2; byte_test:2,>,512,0,relative; classtype:attempted-admin; reference:cve,2026-76501; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76501; sid:202676501; rev:1;)

Elastic Detection

network where
  event.category == "network" and
  network.transport == "ipv6" and
  (
    network.protocol contains "srv6" or
    network.protocol contains "ngoam" or
    process.name contains "ngoam" or
    message contains "SRv6 OAM" or
    message contains "NGOAM"
  ) and
  (
    network.bytes > 1000 or
    event.outcome == "failure"
  )

Splunk SPL Query

index=network sourcetype=cisco:nxos OR sourcetype=cisco:ios
| search ("SRv6" OR "NGOAM" OR "OAM" OR "stack" OR "buffer overflow" OR "reload")
| stats count by src_ip, dest_ip, dest_port, _time
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="cisco,nxos,cve-2026-76501,">
  <rule id="100765" level="15">
    <decoded_as>json</decoded_as>
    <field name="message">(?i)(NGOAM|SRv6 OAM).*?(crash|reload|overflow|corrupt)</field>
    <description>CVE-2026-76501: Potential Cisco NX-OS SRv6 NGOAM exploitation attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve-2026-76501,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround information is currently available.

1) Immediate mitigations:

• If the SRv6 and NGOAM features are not operationally required, disable them on all Cisco NX-OS devices. This removes the attack surface entirely.
• If these features are required, restrict network access to the device's IP interfaces using infrastructure ACLs (iACLs), allowing only trusted management hosts to reach the device.
• Disable any unnecessary IP interfaces and apply strict ingress filtering (e.g., uRPF) to reduce the attack surface.
• Monitor device logs for unexpected reloads, process crashes, or NGOAM-related error messages.
• Consider segmenting the affected devices into isolated network segments with strict firewall policies to limit reachability from untrusted networks.

2) Patch/upgrade steps:

• Monitor Cisco's official security advisory portal (https://sec.cloudapps.cisco.com/security/center/publicationListing.x) for an official fix for CVE-2026-76501.
• Once a fixed NX-OS release is available, schedule an immediate upgrade during a maintenance window for all affected devices.
• Verify the fixed version against the Cisco advisory and test in a lab environment before production deployment.

3) Long-term hardening:

• Implement a vulnerability management program that tracks Cisco NX-OS advisories and applies critical patches within defined SLAs.
• Adopt a defense-in-depth architecture with network segmentation, strict ACLs, and continuous monitoring of network device telemetry.
• Enable and centralize logging for all network devices to detect anomalies and potential exploitation attempts.
• Regularly audit device configurations to ensure only necessary features (such as SRv6 and NGOAM) are enabled.
• Conduct periodic penetration testing focused on network infrastructure protocols, including SRv6 and OAM functions.

References

1. NVD — CVE-2026-76501: https://nvd.nist.gov/vuln/detail/CVE-2026-76501
2. Cisco Security Advisories and Notices: https://sec.cloudapps.cisco.com/security/center/publicationListing.x
3. CWE-121: Stack-based Buffer Overflow — https://cwe.mitre.org/data/definitions/121.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. FIRST EPSS (no score yet): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are currently available for this CVE. CISA KEV status: NO. No public PoC or exploit code has been observed.