Cisco Releases Patches for Multiple Critical Vulnerabilities Across Product Lines
Cisco announced on Wednesday that it has issued security updates addressing 35 vulnerabilities across its portfolio, with more than a dozen classified as critical severity. The patches cover a range of products including Meraki, License On-Prem, NX-OS, Application Policy Infrastructure Controller (APIC), and Finesse, addressing flaws that could lead to unauthorized access, denial of service, remote code execution, and information disclosure.
Meraki Security Hardening Release Addresses Seven CVEs
The Meraki security hardening release resolves multiple bugs grouped under seven CVEs, stemming from shared underlying weaknesses. The most severe flaw in this batch is CVE-2026-76464, which pertains to memory safety issues including buffer overflows and out-of-bounds writes. These types of vulnerabilities are particularly dangerous as they can be exploited to crash systems or execute arbitrary code.
License On-Prem Patches Eight Bugs, Including Five Critical Flaws
Cisco resolved eight vulnerabilities in License On-Prem, five of which are rated critical. Two of these critical flaws — CVE-2026-20328 and CVE-2026-76454 — could allow unauthenticated attackers to gain unauthorized access or trigger denial-of-service conditions, respectively. The absence of authentication requirements increases the risk of exploitation in exposed environments.
The remaining three CVEs in this set — CVE-2026-76482, CVE-2026-76480, and CVE-2026-76483 — address distinct security gaps: missing authentication mechanisms, improper verification of cryptographic signatures, and insufficient protection of sensitive credentials. Each of these issues could undermine the integrity and confidentiality of data processed by the system.
NX-OS Updates Fix 14 Vulnerabilities, Seven Critical
The NX-OS operating system received patches for 14 vulnerabilities, seven of which are critical. Two CVEs — CVE-2026-76455 and CVE-2026-76459 — group together multiple improper access control and out-of-bounds write flaws, which could allow attackers to bypass restrictions or corrupt memory.
Additionally, CVE-2026-76471 and CVE-2026-76465 are critical flaws that could enable remote, unauthenticated attackers to execute arbitrary code with root privileges or cause a denial-of-service condition. These vulnerabilities present a significant risk if exploited in internet-facing deployments.
Three other CVEs — CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 — are only exploitable on Nexus 3000 and Nexus 9000 series switches when Next Generation OAM (NGOAM) is enabled. This limits the attack surface but still requires immediate patching for affected configurations.
APIC Receives Patches for Three Critical CVEs
Cisco also released updates for the Application Policy Infrastructure Controller (APIC), addressing three critical-severity vulnerabilities tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500. These flaws span multiple categories, including improper access control, operating system injection, and memory corruption issues, which together could allow attackers to compromise the controller and gain deep access to managed network infrastructure.
Finesse Update Resolves High-Severity SSRF Flaw
In addition to the critical fixes, Cisco patched a high-severity server-side request forgery (SSRF) vulnerability in Finesse, identified as CVE-2026-20362. This flaw has been publicly disclosed and could allow attackers to manipulate the application into making unintended requests, potentially leading to internal network reconnaissance or interaction with backend systems.
Cisco stated that, as of the advisory release, there is no evidence that any of these vulnerabilities have been exploited in the wild. However, the company urges administrators to apply the updates promptly to mitigate potential risks.
Further details about the patches, including affected versions and mitigation steps, are available in Cisco’s official security advisories and product notifications. Users are encouraged to consult the Cisco Security Advisory portal for complete information.
Source: SecurityWeek