CERT-In Vulnerability Note
CIVN-2026-0495
Multiple Vulnerabilities in Cisco Products
Original Issue Date:October 11, 2026
Severity Rating: CRITICAL
Software Affected
- Cisco Meraki Campus Gateway Software versions 32.2 prior to 32.2.5 and 33.1 prior to 33.1.4
- Cisco Meraki MG Cellular Gateway Software versions 26.1 prior to 26.1.4
- Cisco Meraki MR Wireless Access Point Software versions 30.7 prior to 30.7.3, 31.1 prior to 31.1.8.1, 32.2 prior to 32.2.5, and 33.1 prior to 33.1.3.
- Cisco Meraki MS Series Switch Software versions 18.1 prior to 18.1.9, Cisco IOS XE Software versions 17.15 prior to 17.15.6, 17.18 prior to 17.18.4.1, and 26.1 prior to 26.1.2.
- Cisco Meraki MV Smart Camera Software versions prior to 8.0
- Cisco Meraki MX Security and SD-WAN Appliance Software versions 18.1 prior to 18.107.14, 19.2 prior to 19.2.9, 26.1 prior to 26.1.7, and 26.2 prior to 26.2.3.
- Cisco Nexus 3000 series Switches running Cisco NX-OS Software and NX-API feature enabled.
- Cisco Nexus 9000 Series Switches in standalone NX-OS mode and NX-API feature enabled.
- Cisco UCS 6300 Series Fabric Interconnects, versions 4.2 and earlier, and versions prior to 4.3(6j)
Overview
Multiple vulnerabilities have been identified in various Cisco products that could allow an attacker to execute arbitrary code with root privileges, cause denial of service (DoS), bypass security restrictions, buffer overflows and out-of-bounds writes on the affected systems.
Target Audience:
All IT administrators and organizations using Cisco products.
Risk Assessment:
High risk of remote code execution, denial of service, security restriction bypass, and compromise of affected network infrastructure.
Impact Assessment:
Potential for unauthorized access, disruption of network operations, and reload of the devices.
Description
Cisco Meraki products provide cloud-managed networking, wireless connectivity, switching, security, and SD-WAN capabilities, while Cisco NX-OS Software is a network operating system used in supported Cisco Nexus switches and related networking infrastructure.
Multiple vulnerabilities have been reported in Cisco Meraki products due to improper access control, improper restriction of operations within the bounds of a memory buffer, improper control of a resource through its lifetime, improper input validation, insufficient control-flow management, incorrect calculation, and improper neutralization of special elements. Additionally, a remote code execution vulnerability exists in the NX-API feature of Cisco NX-OS Software due to insufficient input validation of data sent to the NX-API.
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code with root privileges, cause denial of service (DoS), bypass security restrictions, buffer overflows and out-of-bounds writes on the affected systems.
Solution
Apply appropriate updates as mentioned by the Vendor:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j
Vendor Information
Cisco
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
References
Cisco
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j
CVE Name
CVE-2026-76463
CVE-2026-76464
CVE-2026-76467
CVE-2026-76468
CVE-2026-76469
CVE-2026-76470
CVE-2026-76471
CVE-2026-76472
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|