Multiple vulnerabilities in the Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as Next Generation OAM (NGOAM), could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. These vulnerabilities are due to improper input validation of IP traffic when NGOAM is enabled.
Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities
About this summary. This is a short, independently written summary of an article first published by Cisco PSIRT. Cyber Security News did not report or verify the underlying story. Read the original: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU?vs_f=Cisco%20Security%20Advisory%26vs_cat%3DSecurity%20Intelligence%26vs_type%3DRSS%26vs_p%3DCisco%20Nexus%203000%20and%209000%20Series%20Switches%20NGOAM%20Remote%20Code%20Execution%20Vulnerabilities%26vs_k%3D1
Source attribution: headline and facts are from Cisco PSIRT (sec.cloudapps.cisco.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Critical Cisco NX-OS Flaws Threaten Nexus Switches
Critical Cisco NX-OS Flaws Threaten Nexus Switches Cisco has patched five critical vulnerabilities affecting Nexus 3000 and Nexus 9000 switches running standalone NX-OS…
Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability
A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000…
Cisco NX-OS Software NX-API Remote Code Execution Vulnerability
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a…
Cisco Identity Services Engine Remote Code Execution Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating…
Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app (richdocumentscode)…
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three memory bugs…