Cisco Meraki OS: Improper input validation in multiple products
Summary
CVE-2026-76468 is an improper input validation weakness (CWE-20) in Cisco Meraki and Campus Gateway software, found during Cisco's internal review and grouped into the October 2026 hardening release. An unauthenticated remote attacker can send crafted input to affected devices, which may lead to a high integrity impact and a low availability impact, according to the CVSS vector. Cisco states that no exploitation or malicious use is known, and the advisory lists no workarounds.
Affected
- Cisco Campus Gateway software (CG 33.1.3 listed in the CVE record)
- Cisco Meraki MR Wireless Access Points, MV, and MX firmware releases listed in the CVE record and advisory
- Exact per-CVE product and version mapping: check the Cisco advisory directly, as third-party sources differ
- Meraki MG and MS products are listed as vulnerable in the advisory's product section
Fixed in
- Campus Gateway: 32.2.5 (late October 2026) and 33.1.4 (mid-November 2026)
- MG Cellular Gateway: 26.1.4; 4.1.4 only for MG21/E (late October 2026)
- MR Access Points: 30.7.3, 31.1.8.1, 32.2.5, 33.1.3 (verify against Cisco)
- MS Switches: 18.1.9; IOS XE 17.15.6, 17.18.4.1, 26.1.2
- MV Cameras: 8.0
- MX Appliances: 18.107.14 and 19.2.9 (Z3 only; may require Meraki support), 26.1.7, 26.2.3
Workaround
- No workarounds available according to Cisco.
- Compensating measure (not from Cisco): restrict management access and network exposure of unpatched devices.
Exploitation
- Cisco PSIRT is not aware of public announcements or malicious use.
- Vulnerabilities were found during internal testing.
- CISA KEV status: unverified; check the KEV catalog directly.
Our recommendation
- Inventory all Meraki MX, MR, MV, MG, MS and Campus Gateway devices and their firmware versions.
- Patch internet-facing MX appliances and network-exposed MR/MG units first.
- Plan the pending Campus Gateway 33.1.4 and other November releases.
- Monitor the Cisco advisory for updates and KEV changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-hardening-meraki-os-drbEX9GH sec.cloudapps.cisco.com
- Cisco Security Advisory (cisco.com) www.cisco.com
- OpenCVE CVE-2026-76468 app.opencve.io
- Vulners CVE-2026-76468 vulners.com
- eSecurityPlanet overview www.esecurityplanet.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:54.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76468 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.