Cisco Meraki hardening release covers seven flaw classes, top score 9.6

Cisco Meraki hardening release covers seven flaw classes, top score 9.6

15 October 2026: Cisco has updated its security hardening advisory for the Meraki line, adding fixed releases for MS switches and MG cellular gateways to a list that already covered MX security appliances, MR access points, MV cameras and Campus Gateways. The advisory groups the flaws into seven classes, each with one CVE, and the worst class scores 9.6. Cisco says every listed product is affected regardless of configuration, and that no workaround exists.

Seven CVEs, each covering many bugs

Rather than one CVE per bug, Cisco gave one CVE to each weakness class and scored it by the single worst bug inside it:

• CVE-2026-76464, 9.6: memory buffer bounds (buffer overflows, out-of-bounds writes).
• CVE-2026-76463, 8.8: improper access control.
• CVE-2026-76470, 8.8: incorrect calculation, such as integer overflows.
• CVE-2026-76472, 8.8: command and argument injection.
• CVE-2026-76468, 8.2: improper input validation and path traversal.
• CVE-2026-76467, 7.5: resource lifetime errors such as invalid frees.
• CVE-2026-76469, 7.4: control flow, including race conditions.

Cisco found the issues in its own testing, "using existing testing processes as well as frontier AI models", and says it knows of no exploitation. The advisory was first published on 7 October, gained an MX fix on 8 October, and was revised again on 15 October.

Which releases fix it, and which are still to come

The first fixed releases, as Cisco lists them, are:

• MX: 18.107.14 for the 18.1 train, 19.2.9 for 19.2 (recommended only for Z3 devices), 26.1.7 and 26.2.3.
• MR: 30.7.3, 31.1.8.1, 32.2.5 and 33.1.3.
• MS: 18.1.9 for the 17.2 and 18.1 trains; IOS XE 17.15.6, 17.18.4.1 and 26.1.2.
• MG: 26.1.4, plus 4.1.4 for MG21 and MG21E devices only, due in late October.
• MV: 8.0 for cameras on release 7.
• Campus Gateway: 32.2.5 due in late October and 33.1.4 in mid-November.

If 18.107.14 or 19.2.9 does not appear as an option in the dashboard, Cisco tells customers to contact Meraki support. Cloud-managed Catalyst switches are covered by a separate IOS XE hardening advisory from August, with fixed builds delivered through the Meraki dashboard.

Scheduling the upgrades

Because Meraki devices are managed from the cloud dashboard, the practical job is scheduling firmware upgrades per network and accepting the reboot each one brings. Sites with Campus Gateways or MG21 units have no fixed build to install yet, so they need a reminder for late October and mid-November rather than a closed ticket.

We list Cisco Systems, and our network security software category holds six products for teams comparing alternatives.

Related on TrustList:

• ModSecurity web application firewall: bypass and crash flaws fixed in 3.0.17 and 2.9.15, one filename bypass still unpatched
• WatchGuard fixes a critical Fireware OS flaw and two critical access-point flaws: update to Fireware 2026.3.2 and AP firmware 3.4.8
• FBI warns FortiBleed is still hitting exposed FortiGate VPNs

Sources

• Cisco Security Advisory: Cisco Meraki software security hardening release (cisco-sa-hardening-meraki-os-drbEX9GH), version 1.2, 15 October 2026