Cisco Meraki MR, MV, MX and Campus Gateway October 2026 hardening release addresses multiple flaws

What happened

Cisco's networking engineering team carried out an internal security review and produced the October 2026 Meraki security hardening release. The advisory addresses seven internally discovered vulnerabilities: CVE-2026-76464, CVE-2026-76463, CVE-2026-76470, CVE-2026-76472, CVE-2026-76468, CVE-2026-76467 and CVE-2026-76469. Cisco PSIRT states that it is not aware of any public announcements or malicious use of these vulnerabilities.

The most severe issue, CVE-2026-76464, is a buffer management vulnerability with a CVSS v3.1 score of 9.6. Its attack vector is adjacent network access, with low attack complexity, no privileges required and no user interaction. Scope changes, and confidentiality, integrity and availability impacts are all high.

The remaining entries are high severity and include improper access control, improper input validation, resource lifetime errors, incorrect calculation, insufficient control flow and improper neutralization of special elements. Some are reachable over the network without credentials, with integrity or availability impact, while others require adjacent network or local low-privilege access.

Who is affected

Affected products and versions are:

• Cisco Campus Gateway Software: CG 33.1.3
• Cisco Meraki MR Wireless Access Points Software: MR 30.6, MR 32.1.7, MR 32.2.3, MR 32.2.4, MR 33.1.1, MR 33.1.2
• Cisco Meraki MV Firmware: 4.20, 5.0, 5.1, 5.2, 5.3, 5.4, 5.4.1, 5.5
• Cisco Meraki MX Firmware: 16.2, 16.3, 16.4, 16.5, 16.6, 17.3, 17.6, 17.7

These are branch and campus products: MR access points provide wireless connectivity, MV cameras provide physical security video, MX appliances are security and SD-WAN gateways, and Campus Gateway software supports campus networking. Organisations with fleets of Meraki hardware across multiple sites should treat any device running the listed software as in scope. Cisco's advisory does not list individual fixed version numbers; the remedy is the October 2026 hardening release for the product line.

What to do now

1. Review Cisco's advisory for the affected product lines and identify the October 2026 hardening release applicable to your devices.
2. Apply the hardening release to all in-scope Campus Gateway, MR, MV and MX devices. Prioritise devices that are reachable from adjacent or untrusted network segments, and any device that cannot easily be rebooted during business hours.
3. Cisco states that there are no workarounds that address these vulnerabilities. Treat this as a formal patch-cycle milestone rather than relying on configuration changes or access restrictions.
4. Confirm the update by checking the installed firmware or software version after the next dashboard synchronisation.

Beyond the patch

This is a good example of why supply-chain and third-party risk management matters. The advisory spans four product families, multiple firmware trains and many site-level devices; the real exposure window is set by how quickly each site moves from the October 2026 release announcement to the patched firmware. Supply Chain Defense & Third-Party Risk helps track the vendor software you depend on, monitor Cisco's patch cycles, and keep remediation from becoming a manual hunt across every network closet. If you need help assessing your Meraki fleet or planning the update, book a meeting.