Cisco Meraki: Critical hardening release fixes 7 internally discovered vulnerability groups across MG, MR, MS, MV, MX and Campus Gateways (CVE-2026-76463 et al.)
Severity: critical · Patch status: patched · Since 2026-10-07 · CVE-2026-76463, CVE-2026-76464, CVE-2026-76467, CVE-2026-76468, CVE-2026-76469, CVE-2026-76470, CVE-2026-76472
Cisco published a Critical-rated security hardening release for Meraki OS addressing seven internally discovered vulnerability groups, each assigned a CVE by CWE class: improper access control (CVE-2026-76463, CVSS 8.8), memory buffer issues (CVE-2026-76464, CVSS 9.6), resource lifetime control (CVE-2026-76467), input validation (CVE-2026-76468), control flow management (CVE-2026-76469), incorrect calculation (CVE-2026-76470) and injection (CVE-2026-76472). Affected products include Meraki MG cellular gateways, MR access points, MS switches, MV cameras, MX security/SD-WAN appliances and Campus Gateways regardless of configuration. Issues were found in internal testing (including with frontier AI models) and are not known to be exploited. No workarounds exist; fixed releases are shipping or scheduled through mid-November 2026.
What to do
- Upgrade Meraki MX appliances to 18.107.14, 19.2.9 (Z3 only), 26.1.7 or 26.2.3; contact Meraki support if 18.107.14/19.2.9 are not offered
- Upgrade MR access points to 30.7.3, 31.1.8.1, 32.2.5 or 33.1.3
- Upgrade MS switches to 18.1.9, or IOS XE 17.15.6, 17.18.4.1 or 26.1.2
- Upgrade Campus Gateways to 32.2.5 (late Oct) or 33.1.4 (mid-Nov) and MG gateways to 4.1.4 (MG21/E only) or 26.1.4
- Upgrade MV cameras to release 8.0
- For cloud-managed Catalyst devices via Meraki Dashboard, apply the related IOS XE August 2026 hardening release fixes
Fixed versions
- Campus Gateway 32.2.5, 33.1.4
- MG 4.1.4, 26.1.4
- MR 30.7.3, 31.1.8.1, 32.2.5, 33.1.3
- MS 18.1.9, IOS XE 17.15.6, 17.18.4.1, 26.1.2
- MV 8.0
- MX 18.107.14, 19.2.9, 26.1.7, 26.2.3
Sources
All live incidents on Threat Watch
