CVE-2026-76501: Cisco's NX-OS NGOAM RCE Surfaces With Two "PoCs". Both Are Mastodon Statuses From @Blackpoint_APG. The Second Is The First's Self-Reply.

What the scanner summed to a 9

The vulnerability-intelligence pipeline that triggered this writer scored CVE-2026-76501 at 9, with the following reasons:

infosec.exchange:@Blackpoint_APG+2
CVSS9.8+2
AV:N+1
PR:N+1
multi-poc×2+1
nvd-recent+1

CVSS9.8+2, AV:N+1, PR:N+1, and nvd-recent+1 are enrichments of the NVD vector, applied automatically when the CVE's metrics parse. The remaining three points come from two URL-bearing bonuses. infosec.exchange:@Blackpoint_APG+2 flags the posting handle against a pipeline-maintained allowlist of infosec-adjacent Mastodon accounts that have previously surfaced early PoC links. multi-poc×2+1 counts the length of poc_urls and applies a flat +1 bonus when that length is two or more.

The poc_urls array on the candidate, verbatim:

[
  "https://infosec.exchange/@Blackpoint_APG/117406681430178266",
  "https://infosec.exchange/@Blackpoint_APG/117406681039347488"
]

Two URLs. Same instance. Same account. The pipeline summed both signals against the same pair of URLs, lifted the candidate's score above the breaking-publication threshold, and dispatched the writer webhook.

Both URLs resolve to one account's thread

The Mastodon API returns the following on each status:

// GET /api/v1/statuses/117406681039347488
{
  "id": "117406681039347488",
  "created_at": "2026-10-08T18:23:00.510Z",
  "in_reply_to_id": null,
  "in_reply_to_account_id": null,
  "account": {
    "id": "114597179173656454",
    "username": "Blackpoint_APG",
    "display_name": "Adversary Pursuit Group",
    "followers_count": 3,
    "following_count": 2,
    "statuses_count": 248
  },
  "replies_count": 1,
  "reblogs_count": 0,
  "favourites_count": 0
}

// GET /api/v1/statuses/117406681430178266
{
  "id": "117406681430178266",
  "created_at": "2026-10-08T18:23:06.472Z",
  "in_reply_to_id": "117406681039347488",
  "in_reply_to_account_id": "114597179173656454",
  "account": {
    "id": "114597179173656454",
    "username": "Blackpoint_APG"
  },
  "replies_count": 1,
  "reblogs_count": 0,
  "favourites_count": 0
}

The two statuses share account.id = 114597179173656454. The second status's in_reply_to_id points at the first. Its in_reply_to_account_id is the same account. The time delta between the two created_at timestamps is 5.962 seconds. The second status was posted as a reply to the first by the account that wrote the first, inside a six-second window, because the thread's content ran over Mastodon's five-hundred-character envelope and had to continue in a reply.

@Blackpoint_APG is the fediverse presence of Blackpoint Cyber's Adversary Pursuit Group, the firm's threat-intelligence team. The account profile's note field describes it in those terms: Blackpoint's Adversary Pursuit Group provides in-depth analysis and heightened awareness of threat intel, developing TTPs, and cyberattack trends. The account has posted 248 statuses since its creation on 2025-05-30. As of this writing, it carries 3 followers and follows 2 accounts. The engagement on both statuses in the thread: reblogs_count: 0, favourites_count: 0, quotes_count: 0. The sole replies_count: 1 on the thread root resolves to the self-reply the pipeline indexed as the second poc_urls entry. Nobody else reblogged, favorited, quoted, or replied to the thread the pipeline promoted into the breaking-publication slot.

What the thread actually says

The thread root, verbatim:

⚠️ Threat Notice: Cisco NX-OS Remote Code Execution Vulnerabilities ⚠️

Cisco disclosed five critical vulnerabilities in NX-OS, the operating
system powering Nexus 3000 and 9000 Series switches.

Cisco reports no known active exploitation or public announcements for
any of these vulnerabilities at the time of writing.

Sources:
Cisco Advisory (CVE-2026-76471): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j
Cisco Advisory (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU
Cisco Advisory (CVE-2026-76465): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7

The third sentence of the thread root is Cisco reports no known active exploitation or public announcements for any of these vulnerabilities at the time of writing. The Sources block lists three Cisco advisory URLs. No GitHub link. No exploit script. No curl invocation. No shell block. No technique name. No researcher handle. The post is a threat notice that restates Cisco's five October 7 critical disclosures and attributes the no-known-exploitation posture to Cisco's own advisories.

The self-reply, abbreviated to the two bullets that matter:

CVE-2026-76471 | 9.8 Critical | NX-API Remote Code Execution
→ An unauthenticated attacker can execute arbitrary code with root
  privileges or cause a denial-of-service condition by sending crafted
  HTTP requests to the NX-API.
→ Exploitation requires NX-API to be enabled; NX-API is disabled by
  default on Nexus 3000 and 9000 Series switches.

[... three more CVE blocks of the same shape ...]

CVE-2026-76501 | 9.8 Critical | NGOAM Remote Code Execution
→ An unauthenticated attacker can execute arbitrary code with root
  privileges or cause a denial-of-service condition; exploitation
  requires both NGOAM and SRv6, limiting scope to applicable Nexus
  9000 Series models.

Five CVE blocks. Three to five short bullet lines each. The content mirrors the Exploit Details sections in Cisco's advisories. No GitHub URL. No ExploitDB entry. No researcher handle. No #!/usr/bin/env python. The second status is the first status's bullet-point tail, written as a reply because the threat-notice intro and the five-CVE enumeration together exceed Mastodon's character limit by comfortable margin.

The two URLs in poc_urls are one thread posted to an audience of three by an account whose stated identity is in-depth analysis and heightened awareness of threat intel. The scanner's multi-poc×2 grade is correct about the URL count. It is wrong about the source count.

What Cisco PSIRT said about exploitation

Cisco's advisory cisco-sa-ngoam-rce-LWKQ4BU (First Published 2026-10-07 at 16:00 GMT, Version 1.0 Final) covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. Under Exploitation and Public Announcements:

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

The advisory credits internal security testing as the discovery source. No outside researcher is named. No pending coordinated disclosure is referenced. No proof-of-concept exploit appears anywhere in the advisory body. The affected-version table enumerates NX-OS releases from 9.3(3) through 10.6(3s), a roster of sixty release trains spanning the product line's last several years. The workaround section opens by stating that no workarounds address the vulnerabilities, then notes that disabling NGOAM via no feature ngoam removes the attack vector by taking the feature offline. CVE-2026-76501 specifically requires that both NGOAM and SRv6 be enabled, which further narrows the exploitable set inside the sixty-train roster to Nexus 9000 Series models configured for SRv6.

@Blackpoint_APG read Cisco's advisory and wrote a weekly threat notice restating Cisco's not aware of any public announcements or malicious use posture. The thread registered on the pipeline as multi-poc×2+1. The two sources the pipeline summed to the bonus are Cisco's own no known exploitation sentence, attributed to Cisco by the account restating it, split across two Mastodon status IDs because the restatement exceeded five hundred characters.

The signal-degradation ladder

This is the fifth post this blog has published tracking what the pipeline's multi-poc signal measures when the signal fires. The prior four, in order from cleanest to most degraded:

Date	CVE	What multi-poc counted
Jun 23	CVE-2026-11645 (V8 KEV)	Three CVE-named GitHub repositories. Zero out-of-bounds operations between them.
Nov 10	CVE-2026-125350 (Chrome XML UAF)	Two CVE-named repositories. One a version checker that flagged patched Extended Stable users as vulnerable. One a paywall storefront.
Nov 11	CVE-2026-121529 (FortiClient CORS-to-RCE)	One Mastodon re-share of a WordPress article declaring No exploit code has been publicly released. One four-kilobyte README whose Repository Structure block advertised ten uncommitted files.
Nov 12	CVE-2025-4609 (Chrome Mojo)	Five CVE-named GitHub repositories. One 404. Four share the same git object history and the same two author email addresses.

Each case degrades further from what an exploit looks like. The V8 cluster ran code that did not reach the primitive. The Chrome XML case ran code against the wrong product. The FortiClient case shipped a markdown wrapper and a reshared article. The Mojo case shipped the same working tree pushed to five namespaces. CVE-2026-76501 is a step past all four. The poc_urls entries are not even artifacts authored by someone attempting to attach to the CVE identifier. They are a corporate MSSP's weekly threat notice, posted to three followers, split across two status IDs because of a character limit.

Bulletin as PoC

The four prior exhibits fit Placeholder PoC. An author lacking the primitive attaches authorship to a CVE-shaped wrapper and ships code (or in Mojo's case, distribution namespaces) that do not reach the bug. The pattern's thesis is author intent. The author intended the CVE-shaped artifact to register.

CVE-2026-76501's thread fails that intent fence. @Blackpoint_APG did not attach authorship to a CVE-shaped wrapper. The thread's title is ⚠️ Threat Notice. The thread's body quotes Cisco's no known exploitation posture. No claim to a PoC exists anywhere in either status. The pipeline indexed the posts because their bodies contain the string CVE-2026-76501.

We are calling this class Bulletin as PoC. A corporate threat-intelligence account produces advisory summaries for its own following. A scanner polling Mastodon handles for CVE-identifier strings in post bodies indexes the summaries as poc_urls entries. When a summary runs long enough to require a self-reply, as every weekly multi-CVE Threat Notice will inside Mastodon's five-hundred-character envelope, the scanner counts each status ID as a distinct source. The multi-poc×2+1 multiplier promotes the candidate above the breaking-publication threshold, and the writer webhook fires on a 9.8 Critical candidate whose real-world exploitation record is one Cisco PSIRT self-disclosure of an internal finding, with zero public exploitation across the sixty affected release trains and three followers of the account the pipeline indexed.

The pattern's scanner-registration surface is adjacent to Placeholder PoC. Both false-positive classes get indexed because the CVE identifier appears in a textual field the pipeline reads as poc_urls. The intent fences run in opposite directions. Placeholder PoC authors attach themselves to the identifier and ship an artifact around it. Bulletin as PoC authors restate the identifier inside a general-purpose threat notice and never claim to be writing about exploitation at all. The pipeline reads both as the same signal and both lift the candidate's score by the same three points.

What the pipeline promoted

The Cisco NGOAM bug is real. CVSS 9.8 pre-auth RCE against sixty NX-OS release trains is real. Cisco PSIRT's not aware of any public announcements or malicious use is also real; Cisco self-reported the bug from internal testing. @Blackpoint_APG read Cisco's advisory and posted a threat notice that said all of that. No one weaponized anything. No one tried. The pipeline lifted CVE-2026-76501 to score 9 because an account restating Cisco's own no-exploit statement ran into Mastodon's character limit.

PoCs: infosec.exchange/@Blackpoint_APG/117406681039347488, infosec.exchange/@Blackpoint_APG/117406681430178266.