EUVD-2026-94477
GHSA-w26m-hvrg-572c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Meraki/Gateway interface
-
ExploitSend crafted malformed input
-
ExecutionBypass improper input validation (CWE-20)
-
ImpactTamper device integrity, degrade service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires only network reachability to an affected Cisco Meraki MR/MV/MX or Campus Gateway device, with no authentication, no user interaction, and low complexity against default configurations. Limiting factors: the advisory is a bundled internal-hardening release covering multiple CWE-20 input-validation issues without naming the specific vulnerable feature, protocol, or interface, so the exact exposed service and whether it is reachable from untrusted networks versus management-only paths cannot be confirmed from available data; affected-version boundaries are not stated in the input and should be taken from the Cisco advisory. |
| Impact | Signals are moderately strong but partly opaque. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which normally implies broad exposure, and the 8.2 score is driven by high integrity impact (I:H) plus low availability impact (A:L) with no confidentiality impact (C:N). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation probability signals are entirely absent - there is no public exploit identified at time of analysis. Note a data conflict: the 'Information Disclosure' tag implies confidentiality loss, yet the CVSS vector explicitly sets C:N - verify the true impact with Cisco, as the tag and vector disagree. The description is also a generic 'software hardening' bundle covering multiple internally-discovered CWE-20 input-validation issues rather than one characterized bug, so the real-world triggerability of the network/unauthenticated path cannot be independently confirmed from the input. Overall this is a credible medium-to-high priority for Meraki/Campus Gateway operators given the ubiquity of these appliances and the unauthenticated network vector, but the absence of exploitation evidence and the vague, bundled disclosure argue for patch-on-cycle rather than emergency response. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the management or data-plane interface of an affected Cisco Meraki (MR/MV/MX) or Campus Gateway device sends crafted input that bypasses improper input validation (CWE-20), tampering with device integrity and causing partial service degradation. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or complex preconditions are required per the stated metrics. No public exploit code has been identified, and the bundled hardening advisory provides no per-vulnerability technical detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - together with Cisco Campus Gateway Software - allows unauthenticated remote attackers to feed crafted input that the affected device fails to validate, producing a high integrity impact and a limited availability impact (C:N/I:H/A:L) under the assessed CVSS 3.1 vector. The issue is one of a set of CWE-20 weaknesses remediated in a single Cisco internal-hardening firmware release, so the specific vulnerable feature, protocol, or interface is not named and the affected version boundaries must be taken from the Cisco advisory. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); note that the 'Information Disclosure' tag does not align with the assessed vector, which shows no confidentiality impact.
RemediationAI
The primary fix is the vendor hardening release documented in Cisco Security Advisory cisco-sa-hardening-meraki-os-drbEX9GH (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH); exact fixed firmware versions are not present in the supplied data and must be read from that advisory before upgrading, since all CPE version fields are wildcards. Cisco Meraki MR, MV, and MX devices are cloud-managed and are typically brought to the remediated build through scheduled firmware upgrades in the Meraki dashboard (with manual/on-demand upgrade scheduling available), while Campus Gateway Software follows the standard Cisco software upgrade path for that platform. Until the fixed builds are confirmed and deployed, and because the advisory does not name the vulnerable feature, protocol, or interface, no targeted feature-disable workaround can be prescribed; the practical compensating controls are infrastructure-level - restrict reachability of device management interfaces and any exposed device services to trusted management VLANs by tightening ACLs, firewalls, and segmentation so that only administrative networks can reach affected devices, and monitor for anomalous configuration changes consistent with the integrity impact described by the vector. The trade-offs are that over-broad blocking of a Meraki device's outbound paths can break dashboard management, cloud connectivity, and remote troubleshooting, and that the affected devices also pass production traffic, so segmentation rules must be scoped to management-plane ports rather than the data plane. If the advisory ultimately identifies the vulnerable interface, prefer the vendor-released fixed firmware over any partial mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are cloud-managed Cisco networking platforms: Meraki MR access points, MV cameras, and MX security/SD-WAN appliances, which are all provisioned and monitored through the Meraki dashboard, plus Cisco Campus Gateway Software. The root cause class is CWE-20 (Improper Input Validation), used here as a pillar grouping several internally discovered weaknesses rather than a single precisely scoped flaw, which is characteristic of a vendor hardening release that fixes multiple validation defects in one firmware drop. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, the vulnerable code path is reachable over the network with no authentication, no user interaction, and low complexity against default configurations, with the demonstrated impact falling on integrity (I:H) and, secondarily, availability (A:L). The CPE data confirms the affected surface spans four distinct product families (cpe:2.3:a:cisco:cisco_campus_gateway_software, cisco:cisco_meraki_mr_wireless_access_points_software, cisco:cisco_meraki_mv_firmware, cisco:cisco_meraki_mx_firmware), all recorded with wildcard versions, so the precise service that accepts the unvalidated input - and whether it is exposed to untrusted networks or only to management paths - cannot be confirmed from the available data.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Retained network unauthenticated low-complexity vector from the input as the description gives no basis to narrow AV/PR; integrity high and availability low with no confidentiality impact.
Primary rating from Vendor (cisco).
CVSS VectorNVD
DescriptionNVD
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76468 are related to improper input validation that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.
Executive ViewAI
Cisco Meraki MR wireless access points, MV cameras, MX security appliances, and Campus Gateway Software contain an improper input validation vulnerability that could allow remote attackers to compromise data integrity and cause limited availability disruptions. These devices are often critical for network access, physical security, and perimeter defense, so successful exploitation could undermine trust in organizational systems and expose sensitive operations. With no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should prioritize risk mitigation and monitoring until a fix is released.
No vendor-released patch identified at time of analysis; interim mitigations include network segmentation, restricting access to affected devices, and monitoring for anomalous traffic. Consult Cisco advisory for any specific workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB