High priorityDisclosed

Advisory · CVE-2026-76472

Cisco Meraki hardening release fixes injection-class flaws up to CVSS 8.8

Cisco's October 2026 Meraki hardening release addresses internally found improper-neutralization issues grouped under CVE-2026-76472, rated 8.8.

Advisory published October 7, 2026Independent summary
Vendor
Cisco
Product
Cisco Meraki
Identifier / CWE
CVE-2026-76472
CWE-74
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco's cloud-managed network boxes did not scrub special characters out of the data they handle, which is how injection attacks sneak commands in. The update adds the scrubbing.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Internal review

    Cisco's networking engineering team ran a comprehensive internal security review of the Meraki OS portfolio.

  2. 02CVE grouping

    Improper-neutralization-of-special-elements issues (CWE-74 pillar: command, OS, and argument injection) are grouped under CVE-2026-76472, with a maximum CVSS of 8.8.

  3. 03Exposure

    The vulnerabilities affect Meraki Campus Gateways, MR wireless access points, MV smart cameras, and MX security and SD-WAN appliances, regardless of device configuration.

  4. 04Hardened release

    Cisco released hardened software that addresses the vulnerabilities; there are no workarounds.

What happened

On October 7, 2026, Cisco published a Meraki security hardening release. CVE-2026-76472 groups improper-neutralization-of-special-elements issues (CWE-74 pillar, covering command, OS, and argument injection) with a maximum CVSS base score of 8.8, exploitable locally with low privileges in a changed scope with full confidentiality, integrity, and availability impact. The vulnerabilities affect Meraki Campus Gateways, MG cellular gateways, MR wireless access points, MS series switches, MV smart cameras, and MX security and SD-WAN appliances, regardless of device configuration.

Cisco states the flaws were found during internal testing and are not known to be actively exploited. There are no workarounds. Fixed releases per the advisory include Campus Gateway 32.2.5 / 33.1.4, MG 26.1.4, MR 30.7.3 / 31.1.8.1 / 32.2.5 / 33.1.3, MS 18.1.9 (plus IOS XE trains), MV 8.0, and MX 19.2.9 / 26.1.7 / 26.2.3, with some fixes landing later in October or mid-November 2026.

What to do

  1. Check the Meraki dashboard for devices on affected firmware trains.
  2. Schedule upgrades to the fixed releases in the advisory; plan a second pass for the fixes landing later in October or mid-November.
  3. There are no workarounds; limit who holds low-privilege access to affected devices in the meantime, since exploitation needs local access.
  4. Confirm firmware versions after upgrading.

Management note

Injection flaws that need local access are less urgent than remote ones, but Meraki devices often sit in branch offices with shared access. The dashboard-driven upgrade is the same motion as the companion input-validation fix; do both together.