Cisco Patches a Dozen Critical Vulnerabilities

Cisco has released security updates addressing 35 vulnerabilities across several of its product lines, with more than a dozen rated critical. A Meraki hardening update bundles multiple memory-corruption issues, such as buffer overflows and out-of-bounds writes, under seven CVEs, the most severe being CVE-2026-76464. In License On-Prem, Cisco closed eight flaws, five of them critical, including CVE-2026-20328 (unauthorized access) and CVE-2026-76454 (denial of service), both exploitable without authentication, alongside CVE-2026-76482, CVE-2026-76480 and CVE-2026-76483 covering missing authentication, bad cryptographic signature checks, and poorly protected credentials. NX-OS received the largest batch of fixes, 14 vulnerabilities including seven critical ones: CVE-2026-76455 and CVE-2026-76459 group several improper access control and out-of-bounds write bugs, while CVE-2026-76471 and CVE-2026-76465 let unauthenticated remote attackers run code as root or trigger a DoS; three more issues (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) only affect Nexus 3000 and 9000 switches with NGOAM enabled. Cisco also patched three critical flaws in Application Policy Infrastructure Controller (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500) tied to access control, OS command injection and memory corruption, plus a publicly disclosed high-severity SSRF bug in Finesse (CVE-2026-20362). The company says none of these issues are currently being exploited in the wild.