EUVD-2026-94478
GHSA-26vc-m33j-2rwc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold
-
DeliveryReach Meraki/Campus Gateway device
-
ExploitSend crafted traffic triggering CWE-691
-
ExecutionDevice crashes or hangs
-
ImpactDenial of service to dependent clients
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Insufficient control flow management
|
| Exploitation Conditions | Exploitation requires the attacker to be adjacent on the network (AV:A) - i.e., on the same Layer-2 segment, VLAN/broadcast domain, or associated to the affected Cisco Meraki wireless/appliance (MR/MX/MV) or Campus Gateway device; it is not exploitable from a routed/internet position. No authentication (PR:N) and no user interaction (UI:N) are needed against affected software versions, and complexity is low (AC:L). LIMITING FACTORS: the adjacency requirement confines exploitation to attackers with an existing local foothold or wireless/physical proximity, and impact is limited to availability loss (device crash/outage) with no data compromise. The advisory does not name a specific configuration or feature that must be enabled, so all deployed versions in the affected CPE ranges should be presumed exposed until a fixed version is confirmed. |
| Impact | This is a moderate-priority availability (denial-of-service) vulnerability, not a critical emergency. The Cisco-assigned CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) shows the only impact is availability (A:H) with no confidentiality or integrity loss - so despite the 'Information Disclosure' tag in the input, the scored impact is purely a crash/service outage. Attack vector is ADJACENT (AV:A), meaning the attacker must sit on the same Layer-2 segment, broadcast domain, or wireless association as the target - it is NOT remotely reachable across the internet, which materially lowers real-world exposure compared to a network-vector (AV:N) flaw. No EPSS score, CISA KEV listing, or public POC is provided, and the issue was internally discovered by Cisco during a proactive hardening review rather than observed in attacks. CONFLICTING SIGNAL: the 'Information Disclosure' tag contradicts the CVSS C:N metric - treat the real impact as denial of service, not data exposure, and verify with the Cisco advisory. The combination of unauthenticated + low-complexity + adjacent-only + DoS-only means this warrants scheduled patching for exposed Meraki/Campus Gateway fleets but does not indicate active, widespread, or internet-facing exploitation risk. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the same local or adjacent network segment as a vulnerable Cisco Meraki MX/MR/MV device or Campus Gateway (for example via a compromised client, rogue device, or wireless association) sends crafted traffic that triggers the insufficient control-flow handling (CWE-691), causing the device to crash or stop forwarding traffic. No authentication or user interaction is required (PR:N/UI:N), but the attacker must be network-adjacent (AV:A). No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software can be crashed by an unauthenticated attacker positioned on the same Layer-2 adjacency (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) due to insufficient control flow management (CWE-691) fixed in a vendor hardening release. Exploitation is confined to attackers with an existing local foothold or wireless/physical proximity; it is not reachable from a routed or internet position, and the assessed impact is availability loss only, with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw was discovered through Cisco's internal security review rather than through exploitation reporting.
RemediationAI
Patch available per vendor advisory: Cisco has shipped software hardening releases that resolve the issues tracked by CVE-2026-76469, and the exact platform-specific fixed versions are listed in Cisco Security Advisory cisco-sa-hardening-meraki-os-drbEX9GH (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH) - Meraki MR/MX/MV devices are updated through the Meraki dashboard's firmware upgrade controls, so schedule an approved maintenance window and confirm each device reports the fixed build. Where immediate upgrade is not possible, compensate for the Layer-2 adjacency prerequisite: place wireless client, guest and IoT SSIDs on segmented VLANs separate from management and infrastructure segments, enforce 802.1X or MPSK on client-facing SSIDs, restrict wired access ports to known MAC addresses, and disable unused switch ports, accepting that these controls reduce but do not eliminate exposure from an attacker who already holds a foothold in the same broadcast domain. Additionally, enable reboot/crash alerting in the Meraki dashboard so unplanned device resets are detected quickly, since the only assessed impact is availability loss with no confidentiality or integrity compromise and therefore no log-based detection of data exfiltration is possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-691 (Insufficient Control Flow Management) is a parent-class weakness covering failures in how software sequences, validates, and terminates execution paths - for example, missing state-machine enforcement, unhandled error branches, unclear or unreachable exit conditions, and improper handling of unexpected input states. In the context of Cisco's Meraki OS and Campus Gateway software running on embedded networking platforms (wireless access points, security/SD-WAN appliances, and cameras), a control-flow defect of this type typically manifests when a crafted or malformed packet or protocol transition drives a process into an undefined state and the affected device resets or stops forwarding traffic. Cisco states that this CVE covers multiple internally discovered issues grouped under CWE-691 and delivered together in a proactive software hardening release, which means the individual defect triggers are not enumerated in the advisory. The CVSS vector indicates the attacker requires Layer-2 adjacency - same VLAN/broadcast domain, or association with the affected MR/MX/MV or Campus Gateway device - but no credentials (PR:N) and no user interaction (UI:N), with the scope change (S:C) reflecting that a compromise of the embedded device affects resources beyond its own security scope. The supplied CPE inventory covers the Cisco Campus Gateway Software and the MR, MV, and MX firmware families.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Adjacent, unauthenticated, no-interaction DoS warrants AV:A/AC:L/PR:N/UI:N with A:H only; S:C retained per vendor as an outage on a gateway can affect dependent systems.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76469 are related to insufficient control flow management issues that are grouped under the Common Weakness Enumeration (CWE) CWE-691.
Executive ViewAI
Cisco Meraki wireless access points, security appliances, cameras, and Campus Gateway Software are vulnerable to a high-severity flaw that allows an unauthenticated attacker on the same local network segment to crash these devices, causing availability loss. While there is no public exploit identified at time of analysis, the potential for disruption to critical network infrastructure and physical security monitoring warrants management attention. Organizations relying on these devices for connectivity and surveillance should prioritize mitigation planning.
No vendor-released patch identified at time of analysis; interim mitigations include restricting Layer-2 adjacency to trusted devices, implementing network segmentation with port security and 802.1X authentication, and monitoring vendor advisories for a hardening release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) af
Exploit-DB