CVE-2026-76485
waiting for further signalsZero needs more public information before it can validate it.GHSA-cpwq-8jv6-8vg5 ↗EUVD-2026-94467 ↗
no check availablenot proven exploitable
cve.orgpublic pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).kevAttacks confirmed in the real world.
Cisco NX-OS Software 9.2(3); 9.2(2v); 9.2(1); 9.2(2t); 9.2(3y); 9.3(2); 9.2(4); 9.3(1); 9.3(1z); 9.2(2); 9.3(3); 9.3(4); 9.3(5); 9.3(6); 9.3(5w); 9.3(7); 9.3(7k); 9.3(7a); 9.3(8); 9.3(9); 9.3(10); 10.3(1); 10.3(2); 9.3(11); 10.3(3); 9.3(12); 10.4(1); 10.3(99w); 10.3(3w); 10.3(99x); 10.3(3o); 10.3(4); 10.3(3p); 10.3(4a); 10.4(2); 10.3(3q); 9.3(13); 10.3(5); 10.4(3); 10.3(3x); 10.3(4g); 10.5(1); 10.3(3r); 10.3(6); 9.3(14); 10.4(4); 10.3(4h); 10.5(2); 10.3(7); 10.4(5); 10.5(3); 9.3(15); 10.4(4g); 10.5(4); 10.6(1); 10.5(3t); 10.3(8); 10.4(6); 10.5(3s); 10.5(3e); 10.5(3o); 9.3(16); 10.6(1s); 10.6(2); 10.5(3p); 10.3(9); 10.6(2s); 10.6(3); 10.4(7); 10.5(5); 9.3(17); 10.6(2n); 10.6(3s)
ETK-2026-907, permanent identifier
13d 22h 20msince last run
14mAI analysisAnalysis: how long the AI spent reversing this signal.
description
Cisco NX-OS devices using the VXLAN OAM (NGOAM) feature are affected by insufficient validation of IP traffic. An unauthenticated remote attacker who can reach an IP interface may be able to run code with root privileges or trigger a device reload and service disruption.
mitigation
Disable NGOAM where it is not needed, and restrict untrusted network access to IP interfaces on affected devices. Obtain and apply Cisco updates; the evidence does not identify a fixed version.
check
no
exploit
no
automationDeterministic: a check that runs on its own, the same request on every target. Contextual: an agentic technique that needs to be applied per target, for bugs that depend on contextual flows.
contextual
auth requiredWhether an attacker needs an account first, based on the CVSS vector's Privileges Required.
no
EPSSEstimate of the chance this CVE is exploited in the next 30 days. Refreshed daily.
0.51%42nd percentile
agent run time
14m
cve.org record, t = 0The moment cve.org publishes the CVE in full.
2026-10-07 16:17Z
Δ to public pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).
–
Δ to kevAttacks confirmed in the real world.
–
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-07 16:17Zghsa: trigger signal, started the run
- 2026-10-07 16:17Zcve.org record for CVE-2026-76485
this entry in the feed
GET /api/v1/feed/CVE-2026-76485
{ "etk_id": "ETK-2026-907", "cve_id": "CVE-2026-76485", "display_id": "CVE-2026-76485", "ghsa_id": "GHSA-cpwq-8jv6-8vg5", "euvd_id": "EUVD-2026-94467", "status": "published", "anchor_state": "anchored", "title": "Improper input validation in Cisco NX-OS NGOAM", "summary": "Cisco NX-OS devices using the VXLAN OAM (NGOAM) feature are affected by insufficient validation of IP traffic. An unauthenticated remote attacker who can reach an IP interface may be able to run code with root privileges or trigger a device reload and service disruption.", "mitigation": "Disable NGOAM where it is not needed, and restrict untrusted network access to IP interfaces on affected devices. Obtain and apply Cisco updates; the evidence does not identify a fixed version.", "vendor": "cisco", "product": "Cisco NX-OS Software", "affected": [ { "affected_notes": [ "9.2(3)", "9.2(2v)", "9.2(1)", "9.2(2t)", "9.2(3y)", "9.3(2)", "9.2(4)", "9.3(1)", "9.3(1z)", "9.2(2)", "9.3(3)", "9.3(4)", "9.3(5)", "9.3(6)", "9.3(5w)", "9.3(7)", "9.3(7k)", "9.3(7a)", "9.3(8)", "9.3(9)", "9.3(10)", "10.3(1)", "10.3(2)", "9.3(11)", "10.3(3)", "9.3(12)", "10.4(1)", "10.3(99w)", "10.3(3w)", "10.3(99x)", "10.3(3o)", "10.3(4)", "10.3(3p)", "10.3(4a)", "10.4(2)", "10.3(3q)", "9.3(13)", "10.3(5)", "10.4(3)", "10.3(3x)", "10.3(4g)", "10.5(1)", "10.3(3r)", "10.3(6)", "9.3(14)", "10.4(4)", "10.3(4h)", "10.5(2)", "10.3(7)", "10.4(5)", "10.5(3)", "9.3(15)", "10.4(4g)", "10.5(4)", "10.6(1)", "10.5(3t)", "10.3(8)", "10.4(6)", "10.5(3s)", "10.5(3e)", "10.5(3o)", "9.3(16)", "10.6(1s)", "10.6(2)", "10.5(3p)", "10.3(9)", "10.6(2s)", "10.6(3)", "10.4(7)", "10.5(5)", "9.3(17)", "10.6(2n)", "10.6(3s)" ], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "Cisco NX-OS Software", "purl": null } ], "cwes": null, "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": 0.0051, "epss_percentile": 0.423, "epss_asof": "2026-10-20", "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 13.642522733333333, "t0_at": "2026-10-07T16:17:08.503000+00:00", "signals": { "trigger_signal": { "at": "2026-10-07T16:17:08.503000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-07T16:17:08.503000+00:00", "url": "https://github.com/advisories/GHSA-cpwq-8jv6-8vg5" } } }
published 2026-10-07 20:21Z
last change 2026-10-21 18:49Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.