SecBoard
Zurück zur CVE-Übersicht

CVE-2026-76485

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

Beschreibung

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker could exploit this vulnerability by sending crafted packets to an IP interface on an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges and could cause process crashes resulting in a reload and DoS condition.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Detection for crafted packets targeting the NGOAM feature on Cisco NX-OS devices. This is a behavioral detection and may require customization based on network specifics.

Sentinel/Defender KQL

// Cisco NX-OS NGOAM vulnerability (CVE-2026-76485)
// Look for unusual or malformed IP traffic patterns directed at Cisco Nexus switches
// This query is a placeholder and needs specific network flow/packet inspection logs
// to be effective. Consider NetFlow/IPFIX or firewall logs for anomalous traffic.
NetworkFlow
| where DestinationPort == <NGOAM_PORT_IF_KNOWN> or (DestinationIP in (<CISCO_NEXUS_IPS>) and Protocol == "ip")
| summarize count() by SourceIP, DestinationIP, DestinationPort, Protocol
| where count_ > <THRESHOLD_FOR_ANOMALOUS_TRAFFIC>

Splunk SPL

# Cisco NX-OS NGOAM vulnerability (CVE-2026-76485)
# Look for unusual or malformed IP traffic patterns directed at Cisco Nexus switches
# This query is a placeholder and needs specific network flow/packet inspection logs
# to be effective. Consider NetFlow/IPFIX or firewall logs for anomalous traffic.
index=<your_network_flow_index> sourcetype=<your_flow_sourcetype>
| where dest_port=<NGOAM_PORT_IF_KNOWN> OR (dest_ip IN (<CISCO_NEXUS_IPS>) AND protocol="ip")
| stats count by src_ip, dest_ip, dest_port, protocol
| where count > <THRESHOLD_FOR_ANOMALOUS_TRAFFIC>

Sigma

title: Cisco NX-OS NGOAM RCE Attempt
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects potential exploitation attempts against Cisco NX-OS NGOAM feature (CVE-2026-76485) by looking for anomalous IP traffic patterns.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
author: SecBoard
date: 2026/10/07
logsource:
  category: network_traffic
  product: firewall
  service: flow
detection:
  selection:
    # Placeholder: Specific NGOAM traffic patterns or malformed packet indicators are needed
    # This example assumes a high volume of IP traffic to Cisco Nexus devices on an unusual port or with specific flags
    dest_ip: <CISCO_NEXUS_IPS>
    protocol: ip
    # Add more specific conditions if known, e.g., specific flags, payload patterns
  timeframe: 5m
  condition: selection | count() > <THRESHOLD_FOR_ANOMALOUS_TRAFFIC>
level: high

Elastic ES|QL

// Cisco NX-OS NGOAM vulnerability (CVE-2026-76485)
// Look for unusual or malformed IP traffic patterns directed at Cisco Nexus switches
// This query is a placeholder and needs specific network flow/packet inspection logs
// to be effective. Consider NetFlow/IPFIX or firewall logs for anomalous traffic.
FROM network_flow
WHERE destination.port == <NGOAM_PORT_IF_KNOWN> OR (destination.ip IN (<CISCO_NEXUS_IPS>) AND network.transport == "ip")
GROUP BY source.ip, destination.ip, destination.port, network.transport
AGGREGATE flow_count = count()
WHERE flow_count > <THRESHOLD_FOR_ANOMALOUS_TRAFFIC>

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen