Cisco has disclosed seven security vulnerabilities affecting Meraki gateways, switches, wireless access points, and cameras, including a critical flaw rated 9.6 on the CVSS severity scale. While fixes are already available for several products, some firmware updates are not expected until later in October or November.
The vulnerabilities affect six Meraki product families regardless of device configuration. Cisco says there are no workarounds, leaving administrators dependent on the fixed firmware available for each product and software release.
The advisory was published Oct. 7, 2026, and updated the following day with an additional fixed release for MX security appliances. Cisco has not reported known malicious exploitation of the vulnerabilities.
Seven Cisco Meraki vulnerabilities carry scores up to 9.6
According to Cisco's security advisory, the most severe issue, CVE-2026-76464, falls under CWE-119, a category covering memory-buffer errors such as buffer overflows and out-of-bounds writes.
It carries a CVSS score of 9.6 and has an adjacent-network attack vector. Exploitation requires neither authentication nor user interaction, according to Cisco's published severity vector.
The other six vulnerability groups cover problems involving access controls, input validation, resource management, calculations, control flow, and injection.
Cisco lists the following CVEs:
- CVE-2026-76464 (CVSS 9.6): Improper restrictions on memory-buffer operations.
- CVE-2026-76463 (CVSS 8.8): Improper access control.
- CVE-2026-76467 (CVSS 7.5): Improper management of a resource throughout its lifetime.
- CVE-2026-76468 (CVSS 8.2): Improper input validation.
- CVE-2026-76469 (CVSS 7.4): Insufficient control-flow management.
- CVE-2026-76470 (CVSS 8.8): Incorrect calculations.
- CVE-2026-76472 (CVSS 8.8): Improper handling of special elements, including injection weaknesses.
Cisco groups related issues under individual CVE identifiers based on their Common Weakness Enumeration (CWE) category. Each published severity score represents the most serious underlying vulnerability in that group, rather than every weakness sharing the same impact.
The company's engineering teams identified the issues through internal security testing that included existing testing processes and frontier AI models.
Cisco's Product Security Incident Response Team (PSIRT) said it was unaware of public announcements or malicious use of these vulnerabilities when the advisory was issued.
Which Cisco Meraki products need updates?
The advisory covers six Meraki product families:
- Meraki Campus Gateways
- Meraki MG cellular gateways
- Meraki MR wireless access points
- Meraki MS switches
- Meraki MV smart cameras
- Meraki MX security and SD-WAN appliances
Affected software releases and fixes differ across these products. Administrators should match each device's product family and firmware train against Cisco's fixed-release list.
Fixed firmware already available
Cisco identifies the following first fixed releases for several affected product families:
- MG cellular gateways: Release 26.1.4 for the 26.1 train.
- MR wireless access points: Releases 30.7.3, 31.1.8.1, and 33.1.3 for their respective trains.
- MS switches: IOS XE 17.15.6, 17.18.4.1, and 26.1.2 for the corresponding IOS XE trains.
- MV smart cameras: Release 8.0 for the 7-series train.
- MX security appliances: Releases 18.107.14, 19.2.9, 26.1.7, and 26.2.3 for their corresponding trains.
The MX release requirements include important exceptions. Cisco says release 19.2.9 is available only for Meraki Z3 devices.
Customers who cannot find MX releases 18.107.14 or 19.2.9 among their available update options should contact Cisco Meraki Technical Support.
Firmware fixes still pending
Three fixed releases were listed with future availability dates in Cisco's Oct. 8 advisory:
- Campus Gateway 32.2: Release 32.2.5, expected in late October 2026.
- Campus Gateway 33.1: Release 33.1.4, expected in mid-November 2026.
- MS switch 18.1: Release 18.1.9, expected in mid-October 2026.
MR wireless access points running the 32.2 train also require release 32.2.5, which Cisco lists for late October.
These are Cisco's projected availability dates, not confirmation that the firmware has shipped. Administrators should check the current advisory and Meraki Dashboard before scheduling upgrades.
The distinction between product families is particularly important for release 33.1. The first fixed release for MR access points is 33.1.3, while Campus Gateways require the later 33.1.4 build.
A matching version number from another Meraki product family does not necessarily provide protection.
What administrators should do while fixes are pending
Cisco states that no workarounds address these vulnerabilities. The recommended remediation is to install the fixed software listed for each affected product.
For organizations with mixed Meraki deployments, the immediate steps are:
- Inventory affected devices. Identify all Campus Gateways, MG gateways, MR access points, MS switches, MV cameras, and MX appliances, including their firmware versions.
- Match devices to fixed releases. Check Cisco's advisory using the device family and firmware train, not the version number alone.
- Upgrade where fixes are available. Schedule firmware updates and verify the installed releases afterward.
- Track pending firmware. Monitor the expected October and November releases and arrange maintenance windows when they become available.
- Review upgrade access and permissions. Confirm that authorized administrators can manage firmware upgrades through the Meraki Dashboard.
- Check release notes. Review known issues and model-specific limitations before deploying firmware across production devices.
Administrators managing MR access points should pay particular attention to the MR 33.1.3 release notes.
The release includes 12 documented fixes and four known issues. Those known issues should be assessed against the specific access point models in use before upgrading.
Organizations maintaining older firmware also need to review Cisco's Meraki firmware end-of-life policy. Some older firmware trains no longer receive routine maintenance, and their eligibility for security fixes must be confirmed rather than assumed.
Keeping track of fixed releases is an important part of vulnerability management, particularly when different products require different updates.
For security teams managing broader infrastructure environments, patch management processes can also help document outstanding updates and confirm whether remediation has been completed.
Cisco's Meraki advisory leaves administrators with a staggered patch schedule. Organizations can update products with available fixes now, while those using affected firmware without a released fix need to monitor Cisco's published availability dates and prepare maintenance windows as the updates become available.
Also read: Microsoft's September security updates addressed hundreds of vulnerabilities, including two Windows zero-days that attackers had already exploited.