Vulnerabilities · 4h ago
Cisco issued separate October advisories for Cisco Application Policy Infrastructure Controller (APIC) and Cisco Meraki, covering one authenticated APIC file-access flaw and a Meraki hardening release that spans MR access points, MV cameras, and MX appliances. Cisco says none of the issues are known to be actively exploited.
The APIC bug lets an admin submit crafted values in the export-policy interface and reach files the controller should not expose. Cisco says that can leak sensitive files, including key material that may be reused to gain root on APIC and the switches it manages. The Meraki advisory is broader: Cisco bundled multiple internally found flaws into one release across many firmware trains.
For operators, the practical point is that this is not one patch target. If APIC sits in front of managed switching, exposed key material can widen the blast radius beyond the controller itself; Meraki shops may need to line up separate firmware changes across different device classes in the same maintenance window.
CVEs in this update
16 CVEs
Across Cisco NX-OS Software, Cisco Application Policy Infrastructure Controller (APIC), Cisco Meraki MR Wireless Access Points Software, and related packages.
5 critical · 11 high · 0 medium · 0 low
0 in CISA KEV · 0 with EPSS above 1%
Highest severity: CVE-2026-76455 · 9.8 CRITICAL
Showing the top 10 by KEV, EPSS, and severity.
3 sources covering this story
Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities
Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities
Cisco Meraki Hardening Release - Input Validation Vulnerabilities
Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities
Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to access sensitive files on an affected device.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review.
Cisco Security Advisory: Cisco Meraki Security Hardening Release: October 2026
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH
Cisco Security Advisory: Cisco NX-OS Software Security Hardening Release: October 2026
This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
Cisco Meraki Security Hardening Release: October 2026
Cisco Meraki Security Hardening Release: October 2026.
Part of the PlainSec briefing for 2026-10-07