Cisco vulnerabilities, week 41 of 2026: 18 critical pre-auth flaws lead 59 CVEs

The release at a glance

Cisco's week 41 release runs from 5 October to 11 October 2026 and comprises 59 CVEs. Of these, 18 are rated critical, 15 high, 25 medium and 1 unscored. The largest product counts are Splunk Enterprise (22), Cisco NX-OS Software (13), Cisco License On-Prem (8), Cisco Campus Gateway Software (7) and Cisco Application Policy Infrastructure Controller (5). No CVE in this release is listed in CISA's Known Exploited Vulnerabilities catalogue. For the Cisco advisories tracked here, Cisco PSIRT states it is not aware of public announcements or malicious use. The critical set is dominated by network-facing, unauthenticated code-execution and hardening advisories across NX-OS, Splunk and License On-Prem.

What matters most

Cisco License On-Prem. Two critical hardening advisories. CVE-2026-76482 (CVSS 10) groups improper input verification (CWE-347) findings; CVE-2026-76480 (CVSS 9.8) groups missing-authentication (CWE-306) findings. Both are network-reachable without authentication and Cisco rates them critical. Specific fixed versions are not stated.

Splunk Enterprise. CVE-2026-76268 is a missing-authentication issue in the Patroni REST API on search head clusters that lets an unauthorised user with network access execute attacker-controlled operating-system commands. It affects 10.4 before 10.4.3 and 10.2 before 10.2.7; fixes are 10.4.3 and 10.2.7. CVE-2026-76284 covers a group of improper-neutralisation findings, fixed in 10.4.3, 10.2.7, 10.0.10 and 9.4.15.

Cisco NX-OS Software. Six critical items need attention. CVE-2026-76465 (MPLS OAM), CVE-2026-76471 (NX-API) and CVE-2026-76485/76486 (VXLAN OAM, known as NGOAM) allow unauthenticated remote code execution with root privileges or denial of service. CVE-2026-76455 (improper access control) and CVE-2026-76459 (out-of-bounds write) are hardening-release findings affecting NX-OS and, where relevant, NX-OS in ACI mode. Specific fixed versions are not stated.

Cisco APIC. CVE-2026-76498 (improper access control) and CVE-2026-76499 (improper neutralisation) are critical hardening-release findings with network attack vectors and no authentication.

Each of these CVEs has its own advisory page on this site for the details.

Patch in this order

1. Start with Splunk Enterprise search head clusters. Apply CVE-2026-76268 and CVE-2026-76284 by moving to 10.4.3, 10.2.7, 10.0.10 or 9.4.15 as applicable, especially for any search head cluster whose Patroni REST API is reachable.

1. Patch Cisco License On-Prem next. CVE-2026-76482 and CVE-2026-76480 are critical, pre-authentication issues; apply the hardening release for all affected versions. Specific fixed versions are not stated.

1. Patch Cisco NX-OS, including ACI mode. Address CVE-2026-76465, CVE-2026-76455, CVE-2026-76471, CVE-2026-76459, CVE-2026-76485 and CVE-2026-76486 first on internet-facing or management network devices. These are unauthenticated remote code execution and hardening issues.

1. Patch Cisco APIC using the hardening release for CVE-2026-76498 and CVE-2026-76499.

1. Work through the remaining high-severity CVEs by product exposure: Cisco Campus Gateway Software, Cisco License On-Prem, Splunk Enterprise and Cisco Finesse have high-severity findings in the rest of the release.

1. Schedule the 25 medium and 1 unscored findings in normal change windows after the critical and high items.

Beyond the patch

The useful lesson here is that exposure, not exploit proof, is the right triage signal. A single week with 59 Cisco ecosystem CVEs, 18 critical and many reachable without credentials, is much easier to handle if you already know which management interfaces and open ports are internet-reachable. Virtual CISO Services (vCISO) helps keep that exposure inventory current, and Managed Detection & Response (MDR) watches for the privilege escalation, command execution and credential-abuse patterns that these vulnerabilities leave behind.