DEV Community

kozhevniko
kozhevniko

Posted on

CVE-2026-76464 in context: the other identifiers in the same advisory

#cybersecurity #infosec #security

CVE-2026-76464 in context: the other identifiers in the same advisory

Vulnerability overview

Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH, published on 2026-OCT-07 and revised on 2026-OCT-08, groups several internally discovered Meraki and NX-OS issues into seven identifiers. CVE-2026-76464 covers CWE-119 with a maximum CVSS 3.1 base score of 9.6. CERT-In restates the advisory in CIVN-2026-0495.

Where this identifier sits

The advisory's table pairs each identifier with the weakness class it represents and the highest score inside that class.

  • CVE-2026-76463, CWE-284 improper access control, 8.8
  • CVE-2026-76464, CWE-119 memory-buffer restriction, 9.6
  • CVE-2026-76467, CWE-664 resource lifetime control, 7.5
  • CVE-2026-76468, CWE-20 improper input validation, 8.2
  • CVE-2026-76469, CWE-691 control flow management, 7.4
  • CVE-2026-76470, CWE-682 incorrect calculation, 8.8
  • CVE-2026-76472, CWE-74 special-element neutralization, 8.8 Because Cisco grouped by class, the score for each identifier reflects the worst defect inside that class rather than a single finding. A team that remediates only the highest-scoring identifier still leaves the others in place, and the fixed releases address the whole set for a given train.

Mechanism and exploitation conditions

CWE-119 covers buffer overflows and out-of-bounds writes. Cisco states that the issues were found during internal security testing and that no workarounds address them. The vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H requires an adjacent-network position with no privileges or user interaction.

Impact

The vector records high confidentiality, integrity and availability impact with a scope change. Cisco states that the Cisco PSIRT is not aware of public announcements or malicious use.

Affected products and scope

Meraki Campus Gateways, MG Cellular Gateways, MR Wireless Access Points, MS Series Switches, MV Smart Cameras and MX Security and SD-WAN Appliances are affected. Fixed releases span Campus Gateway 32.2.5 to MX 26.2.3 by train.

Exposure context

ZoomEye reports 620,353 assets for app="Cisco Meraki", a fingerprint count rather than a vulnerable-version count.

Remediation and mitigations

Apply the fixed release for each train and verify the running version. One upgrade closes this identifier together with its siblings in the same advisory.

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0495
https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76464

Top comments (0)