Cisco Meraki CVE-2026-76463 (CVSS 8.8): Access-Control Flaw Across MR, MS, MX, MV, MG and Campus Gateway — No Workaround, Fixed Firmware Updated
Cisco's Meraki hardening release fixes seven CVE groups up to CVSS 9.6, including the 8.8-rated access-control flaw CVE-2026-76463, with no workaround and fresh fixed-firmware updates as of 9 November.
What happened
Cisco has updated its Meraki Security Hardening Release advisory (cisco-sa-hardening-meraki-os-drbEX9GH) with new fixed-firmware availability. The release fixes seven groups of vulnerabilities across almost the entire Meraki line-up, and one of the most widely discussed is CVE-2026-76463, an improper access control flaw rated CVSS 8.8 (High).
The advisory was first published on 7 October 2026 and reached its final version, 1.3, on 9 November 2026, when Cisco refreshed the list of fixed releases. The headline message is unchanged: there are no workarounds, so upgrading the firmware is the only fix.
What CVE-2026-76463 is
CVE-2026-76463 falls under CWE-284, improper access control. Cisco describes it as part of a "software hardening release" that addresses multiple vulnerabilities found internally. Each CVE in the release is a group of related issues sharing the same weakness class, and the CVSS score reflects the most severe issue in that group. So CVE-2026-76463 is not a single bug but a bundle of access-control weaknesses, the worst of which scores 8.8.
Cisco has not published technical details of the individual flaws. Improper access control generally means a device does not properly check who is allowed to reach a function or resource, which can let an attacker do things that should require higher privileges.
The rest of the release
CVE-2026-76463 is one of seven CVEs in the same advisory:
- CVE-2026-76464 — CVSS 9.6, CWE-119: out-of-bounds memory operations. This sets the advisory's overall rating to Critical, with an adjacent-network vector (AV:A) that needs no authentication or user interaction.
- CVE-2026-76463 — CVSS 8.8, CWE-284: improper access control.
- CVE-2026-76470 — CVSS 8.8, CWE-682: incorrect calculation.
- CVE-2026-76472 — CVSS 8.8, CWE-74: injection.
- CVE-2026-76468 — CVSS 8.2, CWE-20: improper input validation.
- CVE-2026-76467 — CVSS 7.5, CWE-664: improper resource lifetime control.
- CVE-2026-76469 — CVSS 7.4, CWE-691: insufficient control flow management.
Which devices are affected
Cisco says the following Meraki product families are affected regardless of device configuration:
- MR wireless access points
- MS switches (including Meraki-managed IOS XE switches)
- MX security and SD-WAN appliances
- MV smart cameras
- MG cellular gateways
- Campus Gateways
The advisory does not map each CVE to specific product families, so the safe assumption is that every Meraki device running an affected release needs the update.
Fixed firmware
Cisco lists first-fixed releases per product line. Highlights from the advisory include:
- MR access points: 33.1.3, 32.2.5, with 31.1.8.1 (MR45/55 only) and 30.7.3 (Wi-Fi 5 Wave 2 only) for older lines.
- MS switches: 18.1.9 for the 17.2 and 18.1 lines; IOS XE 17.15.6, 17.18.4.1 and 26.1.2 for Meraki-managed IOS XE switches.
- MX appliances: 26.2.3, 26.1.7, 19.2.9 (recommended only for Z3) and 18.107.14.
- MV cameras: 8.0.
- MG cellular gateways: 26.1.4, and 4.1.4 for MG21/E.
- Campus Gateways: 32.2.5 now, with 33.1.4 expected in mid-November 2026.
Several fixes are limited to specific models, so check the exact entry for each device in Cisco's advisory before scheduling upgrades. If 18.107.14 or 19.2.9 is not offered as an update option on an MX, Cisco says to contact Meraki support.
Exploitation status
Cisco's Product Security Incident Response Team (PSIRT) says it is not aware of any public announcement or malicious use of these vulnerabilities, and that they are not known to be actively exploited. The issues were found by Cisco's own engineering teams during an internal security review.
AI helped find them
One detail stands out: Cisco says the vulnerabilities were found using its existing testing processes together with frontier AI models. That matches a wider trend in 2026, where vendors and researchers are using AI to sweep large codebases and finding flaws in far greater numbers than before. Expect more "hardening releases" like this one: bundles of internally found bugs, grouped by weakness class, with limited technical detail.
What to do
- Inventory every Meraki device and its current firmware in the Meraki Dashboard, including MV cameras and MG gateways, which are easy to forget.
- Upgrade to the first fixed release for each product line, prioritising MX appliances at the network edge and MS switches at the core.
- Schedule upgrades in the Dashboard during a maintenance window. Meraki firmware upgrades usually require a device reboot.
- Watch for the Campus Gateway 33.1.4 release due in mid-November if you run the 33.1 line.
- Limit adjacent-network exposure until patched. The 9.6-rated flaw needs network adjacency, so segment guest and IoT networks away from management interfaces.
- Re-check the advisory, since Cisco has already updated fixed-release availability three times.
The bottom line
CVE-2026-76463 is not known to be exploited, but there is no workaround, and the release it belongs to touches almost every Meraki device type with a top score of 9.6. Because the Meraki Dashboard makes firmware scheduling straightforward, this is one to clear in the next maintenance window rather than leave for later.
