Vulnerabilities
Cisco Patches Over a Dozen Critical Security Flaws Across Key Products
Cisco has released fixes for more than a dozen critical vulnerabilities in its products. The flaws could allow attackers to gain access, steal information, or disrupt services if left unpatched.
Ross GrantUpdated 3 min read
The short version
Cisco has fixed more than a dozen serious security problems in its products. Some of these flaws could let attackers break in, steal information, or take control of devices if not patched. Cisco says it has not seen any attacks using these flaws yet. Users and companies should update their Cisco devices as soon as possible to stay safe.
What happened?
Cisco has released patches for 35 vulnerabilities across its products, including over a dozen rated as critical. The flaws affect Meraki, License On-Prem, NX-OS, APIC, and Finesse. Some could allow unauthorised access or remote code execution. Cisco says it is not aware of any exploitation so far, according to SecurityWeek.
What Cisco Fixed
According to SecurityWeek (opens in a new tab), Cisco has released patches for 35 security vulnerabilities across several of its products. More than a dozen of these are rated as critical. The affected products include Cisco Meraki, License On-Prem, NX-OS, Application Policy Infrastructure Controller (APIC), and Finesse.
The most severe issues involve memory problems like buffer overflows and out-of-bounds writes. These can allow attackers to run code on a device, potentially taking full control. Some flaws can be exploited without even needing to log in (unauthenticated access), making them especially dangerous if left unpatched.
Products and Vulnerabilities Involved
- Meraki: The update addresses multiple bugs grouped under seven CVEs. The most serious, CVE-2026-76464, covers memory issues that could be exploited for remote code execution.
- License On-Prem: Eight bugs fixed, with five rated critical. Two (CVE-2026-20328 and CVE-2026-76454) could allow unauthorised access or denial of service (DoS) without authentication.
- NX-OS: Fourteen vulnerabilities patched, including seven critical. Some allow attackers to execute code with root privileges or cause DoS conditions (CVE-2026-76471, CVE-2026-76465). Others affect only certain Nexus switches with NGOAM enabled.
- APIC: Three critical flaws (CVE-2026-76498, CVE-2026-76499, CVE-2026-76500) involve improper access controls, OS injection, and memory issues.
- Finesse: A high-severity server-side request forgery (SSRF) flaw (CVE-2026-20362) has also been fixed.
How Serious Are These Flaws?
Critical vulnerabilities are the most urgent to fix. They can allow attackers to bypass security, steal data, or disrupt services. Several of these flaws can be exploited remotely and without authentication, meaning attackers do not need a valid username or password.
Cisco says it is not aware of any attacks using these vulnerabilities yet. However, once details are public, attackers often move quickly to exploit unpatched systems. The company has published advisories with more technical details for administrators.
What Should Users and Organisations Do?
System administrators should review Cisco’s security advisories and apply the patches as soon as possible. Unpatched devices could be at risk of unauthorised access, data theft, or service outages. For devices that cannot be patched immediately, consider restricting network access or disabling affected features until updates are applied.
What Happens Next?
There are no reports of these vulnerabilities being exploited in the wild so far. However, given the critical nature of some flaws, organisations should act quickly. Regulators in many countries require companies to protect customer data and may impose fines if breaches occur due to unpatched software. Cisco customers should stay alert for further updates and advisories from the company.
Uncertainties
At this time, only SecurityWeek has reported on these patches. There is no confirmation yet from Cisco or government agencies. Details may change as more information becomes available.
Claimed vs confirmed
- Unconfirmed
Cisco has patched over a dozen critical vulnerabilities across its products.
Reported by SecurityWeek; not yet confirmed by Cisco or government agencies.
- Unconfirmed
No exploitation of these vulnerabilities has been observed in the wild.
SecurityWeek reports Cisco says it is not aware of exploitation, but no primary source is available.
The impact
- Money
- If exploited, these flaws could lead to regulatory fines under laws like GDPR, which can reach up to €20 million or 4% of annual turnover for serious breaches. Actual costs depend on whether attackers exploit the flaws before patching.
- Reputation
- A major vulnerability in Cisco products could damage trust in the brand, especially if exploited before patches are applied. Quick patching helps limit reputational damage.
- Customers
- Customers using affected Cisco products risk unauthorised access, data theft, or service outages if they do not apply updates. They should patch as soon as possible and monitor for further advisories.
Why it matters
These vulnerabilities affect widely used Cisco products. If left unpatched, they could let attackers break into networks, steal data, or disrupt services. Organisations that use these products should update quickly to protect their systems and data.
How does it work?
Many of the flaws involve memory issues such as buffer overflows and out-of-bounds writes. These can let attackers run code on affected devices. Some vulnerabilities allow unauthorised access or denial of service without needing to log in. Others involve missing authentication or improper access controls, which can let attackers bypass security checks.
Key points
- Cisco patched over a dozen critical vulnerabilities across key products.
- Some flaws allow attackers to gain access or run code without logging in.
- No attacks using these flaws have been reported yet, but prompt patching is advised.
- Affected products include Meraki, License On-Prem, NX-OS, APIC, and Finesse.
- Only one outlet has reported this so far; details may change.
Sources
SecurityWeek
Reference
