Cisco Patches 35 Vulnerabilities, Including More Than a Dozen Critical Flaws
Summary
Cisco released patches for 35 vulnerabilities across its products, including more than a dozen critical flaws. The company says it is unaware of any exploitation in the wild.
Key points
- Cisco issued fixes for 35 vulnerabilities across multiple products; more than a dozen are rated critical.
- Meraki updates address bugs including memory-safety flaws grouped under CVE-2026-76464.
- License On-Prem fixes include five critical flaws; two could enable unauthenticated unauthorized access or denial of service.
- NX-OS fixes cover 14 vulnerabilities, including critical flaws that could allow unauthenticated remote code execution with root privileges or cause denial of service.
- APIC received fixes for three critical vulnerabilities involving access control, OS injection, and memory flaws.
- Finesse updates address a publicly disclosed, high-severity SSRF vulnerability, CVE-2026-20362.
- Cisco says it is unaware of any of the vulnerabilities being exploited in the wild.
Article Details
- Vulnerability Types
- Memory issues
- Buffer overflows
- Out-of-bounds writes
- Unauthorized access
- Denial of service
- Missing authentication
- Improper verification of cryptographic signatures
- Insufficiently protected credentials
- Improper access control
- Arbitrary code execution
- OS injection
- Server-side request forgery
- Severity
- Critical and high
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-20328Two of them could lead to unauthorized access (CVE-2026-20328) and DoS conditions (CVE-2026-76454), and could be exploited without authentication.CVE-2026-20362Additionally, the company announced that security updates for Finesse resolve a high-severity SSRF flaw tracked as CVE-2026-20362 that has been publicly disclosed.CVE-2026-76454Two of them could lead to unauthorized access (CVE-2026-20328) and DoS conditions (CVE-2026-76454), and could be exploited without authentication.CVE-2026-76455Multiple improper access control and out-of-bounds write flaws have been grouped together under two CVEs: CVE-2026-76455 and CVE-2026-76459.CVE-2026-76459Multiple improper access control and out-of-bounds write flaws have been grouped together under two CVEs: CVE-2026-76455 and CVE-2026-76459.CVE-2026-76464The most severe of these is CVE-2026-76464, which covers memory issues such as buffer overflows and out-of-bounds writes.CVE-2026-76465Two other bugs, CVE-2026-76471 and CVE-2026-76465, could allow remote, unauthenticated attackers to execute arbitrary code with root privileges or cause a DoS condition.CVE-2026-76471Two other bugs, CVE-2026-76471 and CVE-2026-76465, could allow remote, unauthenticated attackers to execute arbitrary code with root privileges or cause a DoS condition.CVE-2026-76480The remaining three CVEs, CVE-2026-76482, CVE-2026-76480, and CVE-2026-76483, cover multiple security holes across missing authentication, improper verification of cryptographic signature, and insufficiently protectedCVE-2026-76482The remaining three CVEs, CVE-2026-76482, CVE-2026-76480, and CVE-2026-76483, cover multiple security holes across missing authentication, improper verification of cryptographic signature, and insufficiently protectedCVE-2026-76483The remaining three CVEs, CVE-2026-76482, CVE-2026-76480, and CVE-2026-76483, cover multiple security holes across missing authentication, improper verification of cryptographic signature, and insufficiently protectedCVE-2026-76485The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.CVE-2026-76486The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.CVE-2026-76498Tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, they cover multiple improper access control, OS injection, and memory flaws.CVE-2026-76499Tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, they cover multiple improper access control, OS injection, and memory flaws.CVE-2026-76500Tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, they cover multiple improper access control, OS injection, and memory flaws.CVE-2026-76501The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.
Vendors
Products
Application Policy Infrastructure Controller (APIC)Cisco also rolled out patches for three critical-severity CVEs in Application Policy Infrastructure Controller (APIC).FinesseAdditionally, the company announced that security updates for Finesse resolve a high-severity SSRF flaw tracked as CVE-2026-20362 that has been publicly disclosed.License On-PremCisco also resolved eight bugs in License On-Prem, including five critical-severity issues.MerakiA fresh Meraki security hardening release fixes multiple bugs grouped together under seven CVEs, based on the underlying weakness type.Next Generation OAM (NGOAM)The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.Nexus 3000The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.Nexus 9000The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.NX-OSNX-OS received fixes for 14 vulnerabilities, including seven critical-severity issues.