Cisco on Wednesday announced patches for 35 vulnerabilities in its products, including more than a dozen critical-severity bugs.
A new security hardening release from Meraki fixes several bugs grouped into seven CVEs depending on the type of underlying vulnerability. The most serious of these is CVE-2026-76464, which covers memory issues such as buffer overflows and out-of-bounds writes.
Cisco also fixed eight bugs in License On-Prem, including five critical severity issues. Two of them could lead to unauthorized access (CVE-2026-20328) and DoS conditions (CVE-2026-76454) and could be exploited without authentication.
The remaining three CVEs, CVE-2026-76482, CVE-2026-76480, and CVE-2026-76483, cover multiple vulnerabilities including lack of authentication, improper cryptographic signature verification, and inadequately protected credentials.
NX-OS received fixes for 14 vulnerabilities, including seven critical severity issues. Several flawed access controls and out-of-bounds typos have been grouped under two CVEs: CVE-2026-76455 and CVE-2026-76459.
Two additional flaws, CVE-2026-76471 and CVE-2026-76465, could allow remote, unauthenticated attackers to execute arbitrary code with root privileges or cause a DoS condition.
The remaining three issues, CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501, can only be triggered on Nexus 3000 and Nexus 9000 series switches that have Next Generation OAM (NGOAM) enabled.
Cisco has also deployed patches for three critical severity CVEs in the Application Policy Infrastructure Controller (APIC). They are tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500 and cover several flawed access controls, operating system injections, and memory errors.
Additionally, the company announced that security updates for Finesse address a serious SSRF flaw known as CVE-2026-20362 that has been publicly disclosed.
Cisco says it has no knowledge of any of these vulnerabilities being exploited in the wild. For more information, visit the company’s website Safety instructions side or in his Notifications.
Related: SonicWall and Splunk fix critical security vulnerabilities
Related: FortiBleed attackers lock victims out of Fortinet devices
Related: Chrome 155 Update fixes 247 security vulnerabilities
Related: Atlassian fixes a critical security vulnerability affecting 8 products
