Cisco Meraki: critical flaws in firewall, switch, Wi-Fi and camera firmware

What happened

On October 7, 2026, Cisco published a security advisory titled Cisco Meraki Security Hardening Release: October 2026 and rated it critical. It covers the firmware of Meraki network devices, meaning switches, Wi-Fi access points, firewalls and SD-WAN appliances, cellular gateways and cameras, as well as Cisco Campus Gateway devices.

This is not a single bug but a bundle of vulnerabilities that Cisco found during its own internal security review. Cisco says it used its existing testing processes as well as frontier AI models to find them. The company grouped the bugs into seven categories by type and assigned one CVE identifier to each group.

According to Cisco, the flaws are not known to be actively exploited, and the Cisco PSIRT security team is not aware of any public announcements about them. Cisco has released fixed firmware, but version 33.1.4 for Campus Gateway is not due until mid-November 2026. Cisco has updated the advisory several times, most recently on November 9, 2026.

Why it is dangerous

The most serious group, CVE-2026-76464, covers memory handling bugs such as buffer overflows. Picture a glass that someone keeps filling past the brim. The water spills over and soaks everything around it. In software, data overwrites neighboring memory, which can let an attacker disrupt or influence how the device runs.

Cisco rated this group 9.6 out of 10 under CVSS 3.1, which is critical. CVSS is the international scale for rating how severe a vulnerability is. According to Cisco, each group’s score reflects the single most severe bug within it. Overview based on Cisco’s ratings:

CVE-2026-76464 (9.6): memory errors, buffer overflows
CVE-2026-76463 (8.8): improper access control and privilege bypass
CVE-2026-76470 (8.8): calculation errors such as integer overflow
CVE-2026-76472 (8.8): command injection
CVE-2026-76468 (8.2): improper input validation
CVE-2026-76467 (7.5): improper handling of resources and memory
CVE-2026-76469 (7.4): control flow issues such as infinite loops

One key condition: for the most severe bugs, Cisco’s rating says an attacker needs no login and no user interaction, but must be on the same local network as the device. According to the rating, it cannot be done directly from the internet. CVE-2026-76472 requires local access and low privileges. Cisco has not said exactly what an attacker could achieve, but for CVE-2026-76464 the rating assumes a high impact on confidentiality, integrity and availability.

The four most severe groups are not in the CISA KEV catalog, where the US agency CISA lists vulnerabilities with confirmed exploitation, and the European EUVD database records no exploitation for them either. Their EPSS scores, which estimate the probability of exploitation within the next 30 days, were only 0.13% to 0.2% as of November 9, 2026.

Who is affected

According to Cisco, the following products are vulnerable regardless of configuration if they run firmware older than the first fixed release:

Cisco Campus Gateway
Meraki MG cellular gateways
Meraki MR Wi-Fi access points
Meraki MS switches
Meraki MV smart cameras
Meraki MX security and SD-WAN appliances, including the Z3

Meraki is popular with small and mid-sized companies, schools and branch office networks because everything is managed from the cloud-based Meraki Dashboard. A typical setup is a firewall at the network edge, switches in the server room and Wi-Fi access points for staff and guests.

Cisco says no other products are known to be affected by these flaws. If you also manage Cisco Catalyst devices through the Meraki Dashboard, a separate advisory applies to them: Cisco IOS XE Software Security Hardening Release: August 2026.

How to check if you are affected

The easiest place to look is the Meraki Dashboard. Under Organization > Firmware upgrades you can see the current firmware version for each network and device type. Each device’s own page also shows its firmware version.

If you use the Meraki Dashboard API, you can list all devices with their firmware versions using a read-only request. An API key with read-only access is enough.

curl -s -H "Authorization: Bearer $MERAKI_API_KEY" "https://api.meraki.com/api/v1/organizations/ORG_ID/devices"

Replace ORG_ID with your organization ID, which you can get from https://api.meraki.com/api/v1/organizations. Compare the value in the firmware field with the list of fixed versions in the next section.

How to fix it

Cisco states that there are no workarounds. Updating the firmware is the only protection. First fixed releases by product line:

Campus Gateway: 32.2 → 32.2.5, 33.1 → 33.1.4 (announced by Cisco for mid-November 2026)
MG: 4.1 → 4.1.4 (MG21/E only), 26.1 → 26.1.4
MR: 30.7 → 30.7.3 (Wi-Fi 5 Wave 2 family only), 31.1 → 31.1.8.1 (MR45/55 only), 32.2 → 32.2.5, 33.1 → 33.1.3
MS: 17.2 and 18.1 → 18.1.9, IOS XE 17.15 → IOS XE 17.15.6, IOS XE 17.18 → IOS XE 17.18.4.1, IOS XE 26.1 → IOS XE 26.1.2
MV: 7 → 8.0
MX: 18.1 → 18.107.14, 19.2 → 19.2.9 (recommended for Z3 only), 26.1 → 26.1.7, 26.2 → 26.2.3

Recommended steps:

Make an inventory of all your Meraki devices and their current versions.
Start where people or devices you do not fully trust connect to the network: guest Wi-Fi, branch offices, public areas. The attack requires access to the local network.
In the Meraki Dashboard, schedule the upgrade under Organization > Firmware upgrades outside business hours. Devices will reboot and be briefly unavailable.
If 18.107.14 or 19.2.9 is not offered as an update option, Cisco advises contacting Cisco Meraki technical support.
After the upgrade, confirm the version the same way as described in the previous section.

Until the update is in place, a general precaution is to limit who can connect to each network segment. Keep guest Wi-Fi separate from the company network and do not let unknown devices plug into your cabling. Cisco does not list this as a substitute for the fix, though.

What if you may already be compromised

Cisco is not aware of any exploitation of these flaws and has not published any indicators of compromise. A quick review does no harm, though, especially if you run an open guest network.

In the Meraki Dashboard, go through Organization > Change log and look for configuration changes nobody on your team made.
Under Organization > Administrators, check for unknown admin accounts.
In Network-wide > Event log, look for unexpected device reboots or outages.
Check whether firewall rules, VPN settings or Wi-Fi networks have changed.

If you find changes you cannot explain, an unknown account or odd network behavior, contact Cisco Meraki technical support or an incident response specialist. Do not delete anything in the meantime so that the evidence is preserved.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.