Cisco Meraki: Improper access control in multiple firmware releases
Summary
Cisco has published a software hardening release for Meraki products that includes CVE-2026-76463, an improper access control issue (CWE-284) found by Cisco's internal review. The CVE covers authorization, authentication, privilege and bypass weaknesses, rated CVSS 8.8 with a changed scope. Based on the vector, an attacker with adjacent network access and no privileges or user interaction could potentially gain high confidentiality impact and low integrity and availability impact.
Affected
- Campus Gateway: CG 33.1.3
- Meraki MR Wireless Access Points: MR 30.6, 32.1.7, 32.2.3, 32.2.4, 33.1.1, 33.1.2
- Meraki MV Smart Cameras: 4.20 to 6.0 (multiple releases, see CVE record)
- Meraki MX Security and SD-WAN Appliances: 16.2 to 18.1 (multiple releases, see CVE record)
- Per-CVE mapping to be verified against the Cisco advisory, as the advisory bundles several CVEs.
Fixed in
- Per the Cisco advisory table (verify on the advisory page before rollout):
- MR: 30.7.3, 31.1.8.1, 32.2.5, 33.1.3
- MX: 18.1 line (asterisked release, contact Meraki support if not offered), 19.2.9 (Z3 only), 26.1.7, 26.2.3
- MV: 8.0
- Campus Gateway: 32.2.5 (late Oct 2026), 33.1.4 (mid-Nov 2026)
Workaround
No workarounds available.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
Our recommendation
- Inventory all Meraki devices (MX, MR, MV, Campus Gateway) and their firmware versions in the Meraki Dashboard.
- Plan patching to the fixed releases listed in the advisory, testing on a pilot device first.
- Until patched, restrict management access and limit adjacent-network exposure, for example by separating guest and IoT segments.
- Monitor for unusual configuration changes or access on Meraki devices.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory: Cisco Meraki Security Hardening Release: October 2026 sec.cloudapps.cisco.com
- Cisco Security Advisory (cisco.com copy) www.cisco.com
- Vulners VulnRichment: CVE-2026-76463 vulners.com
- OpenCVE: CVE-2026-76463 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:18.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76463 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.