Cisco issues 35-Vulnerability Patch batch, flags Critical NX-OS and APIC Flaws

This is a new development in a story we reported earlier: Cisco Patches Five Critical NX-OS Flaws That Let Attackers Seize Root on Nexus Switches.

Cisco announced fixes for 35 vulnerabilities across its products, including more than a dozen rated critical, and disclosed three NX-OS flaws (CVE-2026-76485, CVE-2026-76486, CVE-2026-76501) affecting Nexus 3000 and 9000 series switches with Next Generation OAM enabled that allow a remote unauthenticated attacker to run code as root or cause denial of service; some flaws were found internally using frontier AI models alongside existing testing, according to SecurityWeek and The420.in.

SecurityWeek and The420.in report that the batch spans NX-OS (Cisco’s network operating system) switches, APIC controllers, License On-Prem servers, Meraki gear and Finesse components, and that the flaws span switching, controller, licensing and wireless domains.

Three NX-OS flaws affect only Nexus 3000 and 9000 series switches with Next Generation OAM enabled, allowing a remote unauthenticated attacker to run code as root or cause denial of service. Cisco states that no workaround fully addresses the NGOAM flaws, making fixed NX-OS releases necessary.

Beyond the NGOAM trio, NX-OS received fixes for 14 vulnerabilities total, seven of them critical, according to SecurityWeek and The420.in. Related flaws are grouped under CVEs including CVE-2026-76455 and CVE-2026-76459, while CVE-2026-76471 and CVE-2026-76465 can enable root‑level code execution or denial of service by remote unauthenticated attackers. The vulnerable NX-OS equipment spans the MDS 9000 line, the Nexus 3000, 7000 and 9000 series, Nexus switches running in ACI mode, and select UCS Fabric Interconnects.

Three critical APIC flaws cover improper access control, OS injection and memory issues. Each is rated CVSS 9.8, affects installations regardless of configuration and has no workaround, per SecurityWeek and The420.in.

License On-Prem received fixes for eight bugs, five of them critical, according to SecurityWeek and The420.in. Unauthenticated access flaws include CVE-2026-20328 and a denial‑of‑service issue tracked as CVE-2026-76454.

The remaining critical issues involve missing authentication, improper signature verification and insufficiently protected credentials, corresponding to CVE-2026-76482, CVE-2026-76480 and CVE-2026-76483. These are among the critical flaws addressed in the License On-Prem advisory.

Meraki’s release addresses seven CVEs, headed by CVE-2026-76464, which covers memory‑safety problems such as buffer overflows and out‑of‑bounds writes and scores CVSS 9.6. Not all fixed Meraki versions are available yet; some are slated for later October or November, so admins must verify device model and software branch.

Affected Meraki products include campus gateways, cellular gateways, wireless access points, switches, smart cameras and MX security/SD‑WAN appliances. The hardening release covers memory‑safety issues and other bug classes.

A high‑severity SSRF flaw in Finesse, CVE-2026-20362, was disclosed before the patch; no exploitation has been reported. The flaw was publicly disclosed before the patch became available.

The three NGOAM flaws affect only Nexus 3000 and 9000 switches with NGOAM enabled. APIC installations are in scope regardless of configuration. Some of the flaws were uncovered internally using frontier AI models alongside existing testing, according to SecurityWeek and The420.in.

Cisco groups related flaws under single CVEs, so the published count understates the total defects, and internal testing with frontier AI models uncovered more flaws. In September 2026, Cisco addressed 18 Secure Firewall vulnerabilities, among them CVE-2026-20332, which attackers had exploited in the wild.

In September 2026 Cisco patched 18 Secure Firewall (ASA, FTD, FMC) flaws, including CVE-2026-20332, which was reported as exploited in the wild, according to BeyondMachines. The October batch, by contrast, includes no known exploitation according to the vendor.