EUVD-2026-94475
GHSA-jfm4-3jqp-3352
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network foothold (wireless/LAN)
-
DeliverySend crafted request to Meraki/Campus Gateway service
-
ExploitBypass improper access control (CWE-284)
-
ExecutionCross security boundary (scope change)
-
ImpactAccess protected data or functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be on an adjacent network (AV:A) - physically or logically on the same Layer 2 / wireless segment as the affected device, such as an associated client of a Meraki MR access point or a host on the same LAN as an MX security appliance, MV camera, or Campus Gateway. No authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L), so once adjacency is achieved exploitation against affected firmware is straightforward. The limiting factors defenders should weigh: the attack is NOT routable from the internet, so exposure depends on who can reach the management/data plane of these devices on local segments; impact is also version-specific, and the generic bundled advisory means the exact triggering configuration or feature is not disclosed - confirm affected versions against cisco-sa-hardening-meraki-os-drbEX9GH before assessing individual devices. |
| Impact | This is a credible but not top-tier emergency priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L, base 8.8) indicates an unauthenticated, low-complexity attack from an adjacent network (same L2/wireless broadcast domain) with a scope change and high confidentiality impact - consistent with the 'Authentication Bypass' / improper access control (CWE-284) classification. The adjacency requirement (AV:A rather than AV:N) is the single biggest mitigating factor: an attacker must already be on the local/wireless segment, not the open internet, which meaningfully narrows the exploitation surface. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. SSVC framing would likely land at 'exploitation: none' with 'technical impact: total' but low automatability given the adjacency precondition. A key limitation: the description is deliberately generic (a bundled internal-hardening release covering 'multiple internally discovered vulnerabilities' under one CVE), so the specific vulnerable component, affected versions, and exact attack mechanism are NOT disclosed and must be confirmed against the Cisco advisory. Net: treat as a prioritized patch for exposed Meraki/Campus Gateway fleets, especially where untrusted devices share the wireless/LAN segment, but not an internet-facing drop-everything emergency on the evidence available. |
| Exploit ScenarioDerived | An attacker with a foothold on the adjacent network segment - for example a rogue or compromised client associated to a Meraki MR wireless access point or a device on the same LAN as an MX firewall - sends crafted traffic that bypasses access-control checks, gaining unauthorized access to protected functions or data and crossing a security boundary (scope change). No credentials or user interaction are required. No public exploit code is identified at time of analysis, so exploitation would require independent vulnerability research against the affected firmware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software - lets an attacker positioned on an adjacent Layer 2 or wireless segment bypass authentication and reach protected functionality, with the highest impact on confidentiality. No credentials (PR:N) and no user interaction (UI:N) are required, attack complexity is low, and the Cisco-assigned score is 8.8 because the flaw crosses a security boundary (S:C); however, the attack is not routable from the internet, so real-world exposure is limited to whoever already shares a segment with the device, and no public exploit code or confirmed active exploitation was identified at time of analysis. Cisco addressed the issue in a proactive internal hardening release and published advisory cisco-sa-hardening-meraki-os-drbEX9GH, which should be used to confirm exact affected firmware versions because the advisory bundles several internally discovered issues.
RemediationAI
Apply the Meraki OS hardening firmware release published under Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH), which is the authoritative source for the exact fixed versions per platform; because the advisory bundles multiple internally discovered flaws, confirm the fixed release for each MR, MX, MV, and Campus Gateway model individually rather than assuming a single dashboard-wide upgrade covers everything, and schedule maintenance windows since Meraki firmware upgrades reboot devices and can briefly interrupt wireless, VPN, and camera services. Cisco's cloud-managed upgrade mechanism can be staged or scheduled, so prioritize devices on segments reachable by untrusted clients (guest wireless, shared switch ports, camera VLANs). No exact patched version number is available in the supplied data, and no vendor-released patch text exists beyond the advisory reference; until upgrades complete, the effective compensating control is network-layer: keep affected devices off any segment shared with untrusted or guest clients by enforcing per-SSID client isolation and private VLANs on Meraki MR, restricting switch-port access and using 802.1X or MAC-based port security on the wired side for MX and Campus Gateway, and placing MV camera and MX management interfaces on a dedicated management VLAN with ACLs that deny lateral traffic from user VLANs. The trade-off is operational - client isolation breaks peer-to-peer and some IoT discovery traffic, and strict management-VLAN ACLs require inventory work and can lock out administrators who rely on ad-hoc local access - so validate rules against legitimate traffic patterns before enforcement. Monitor the advisory for updates, since new firmware revisions or additional CVE identifiers may be added as Cisco completes its review.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-284 (Improper Access Control), and Cisco's own tagging associates the bundled fixes with authentication bypass behavior in Meraki OS. The CVSS v3.1 vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L describes an adjacent-network, low-complexity, unauthenticated attack that changes scope - meaning a compromise or control bypass in one component (for example an access point or camera on the same broadcast/wireless domain) is assessed as affecting resources beyond the vulnerable component's own security authority, which is why confidentiality is rated High while integrity and availability are rated Low. Affected CPE data covers cpe:2.3:a:cisco:cisco_campus_gateway_software, cpe:2.3:a:cisco:cisco_meraki_mr_wireless_access_points_software, cpe:2.3:a:cisco:cisco_meraki_mv_firmware, and cpe:2.3:a:cisco:cisco_meraki_mx_firmware; the wildcard version ranges indicate that the advisory defines the vulnerable firmware versions rather than this CVE entry. Practically, the prerequisite is logical or physical adjacency: an associated wireless client of an MR AP, or a host on the same LAN/VLAN as an MX appliance, MV camera, or Campus Gateway, with the management or data plane reachable on that local segment. Because the advisory is a grouped hardening release, the specific triggering configuration or feature is not publicly enumerated, so per-device exposure must be validated against the advisory rather than inferred from the CVE description alone.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Adjacent vector (AV:A) and unauthenticated access (PR:N) retained per vendor data for an access-control bypass on L2/wireless-reachable appliances; scope change (S:C) reflects crossing a security boundary, with high confidentiality and limited integrity/availability impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76463 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-284.
Executive ViewAI
Cisco Meraki firmware across MR wireless access points, MX security appliances, MV cameras, and Cisco Campus Gateway Software contains an access control weakness that allows someone already present on the same wired or wireless segment to reach protected device functionality without credentials; no public exploit has been identified at time of analysis and no exact fixed firmware version is named in the vendor guidance. Because the attack is not routable from the internet, the realistic exposure is concentrated in shared guest, branch, campus, and retail networks where untrusted users, contractors, or IoT devices sit on the same Layer 2 domain as Meraki hardware. Leadership should treat this as a network segmentation and access-hygiene risk to the confidentiality of traffic and device data on those segments rather than an internet-facing emergency.
No vendor-released patch identified at time of analysis; consult Cisco advisory cisco-sa-hardening-meraki-os-drbEX9GH to confirm affected and fixed firmware versions and request the hardening release through Cisco TAC. Interim mitigations: enforce Layer 2 segmentation so untrusted clients never share a broadcast domain with Meraki management or protected interfaces; enable client isolation and disable client-to-client bridging on MR SSIDs; enable DHCP snooping, dynamic ARP inspection, and port security on access switches; place all Meraki management interfaces on a dedicated management VLAN; restrict wireless and wired access to known devices via 802.1X or MAC authentication; and monitor Meraki dashboard and switch telemetry for anomalous peer-to-peer or cross-segment activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB