Cisco Meraki: Improper neutralization of special elements (injection)

Summary

Cisco's October 2026 Meraki security hardening release fixes CVE-2026-76472, a group of internally discovered flaws classed as CWE-74 (improper neutralization of special elements, such as command, OS or argument injection). NVD rates it 8.8 (CVSS 3.1, local attack vector, low privileges required, scope changed, high confidentiality, integrity and availability impact). Per the advisory and CISA SSVC data, an attacker would need local or low-privileged access to a device, and successful exploitation could give full control over the affected device.

Affected

• Per the CVE record, affected product lines include Campus Gateway (CG 33.1.3), Meraki MR (30.6, 32.1.7, 32.2.3, 32.2.4, 33.1.1, 33.1.2), Meraki MV (4.20 to 6.0) and Meraki MX (16.2 to 18.1).
• The exact affected versions for CVE-2026-76472 alone are unknown; the advisory covers a seven-CVE group.
• Cisco lists MG, MS and other lines as affected in the advisory.

Fixed in

• Per-CVE fixed versions: Unknown.
• Product-level fixes named in the advisory: MX 18.107.14 (18.1 line), 19.2.9 (Z3 only), 26.1.7, 26.2.3; MS 18.1.9, IOS XE 17.15.6, 17.18.4.1, 26.1.2; MV 8.0; MR 30.7.3, 31.1.8.1, 32.2.5, 33.1.3; Campus Gateway 32.2.5 (late October 2026) and 33.1.4 (mid-November 2026); MG 26.1.4.
• Some fixed releases were not yet available at the advisory date; check Cisco's current fixed-release table.

Workaround

No workarounds available.

Exploitation

• Cisco PSIRT is not aware of public announcements or malicious use of these vulnerabilities (per CVE record).
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept or CISA KEV listing found.

Our recommendation

• Inventory all Meraki MR, MS, MV, MX and Campus Gateway devices and their firmware versions.
• Patch affected devices in the next maintenance window, using the fixed release for each product line; prioritise devices with management or WAN reachability.
• Since no workaround exists, plan upgrades where fixed releases are not yet available and recheck Cisco's table.
• Monitor the advisory for updates and for the related CVE-2026-76464 (rated 9.6).

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory: Meraki Security Hardening Release October 2026 sec.cloudapps.cisco.com
• Cisco Security Advisory (mirror) www.cisco.com
• OpenCVE: CVE-2026-76472 app.opencve.io
• Vulners: CVE-2026-76472 vulners.com
• Tech Jack Solutions: Cisco Meraki hardening release analysis techjacksolutions.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:18.