EUVD-2026-94480
GHSA-9ffr-55f5-qhvm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Meraki/Campus Gateway service
-
ExploitSend crafted network request
-
ExecutionTrigger improper resource-lifetime fault
-
ImpactCrash or hang device (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource lifecycle control
|
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special configuration is stated as required: a remote attacker need only reach the affected network service on a Cisco Meraki MX/MR/MV or Campus Gateway device. The practical LIMITING factors are: (1) the device's vulnerable service/interface must be network-reachable by the attacker (management/data-plane exposure depends on deployment and firewall posture); (2) impact is confined to availability (device crash/DoS) with no data compromise; and (3) the advisory bundles multiple internally discovered CWE-664 issues without specifying the exact triggering feature, protocol, or firmware versions, so the precise vulnerable component cannot be named from the available data - confirm against the Cisco advisory. |
| Impact | This is a bundled 'software hardening' disclosure from Cisco's internal security review, so the per-issue technical detail is deliberately thin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw whose ONLY impact is availability (C:N/I:N) - i.e. a remote denial-of-service, not data exposure or code execution. This directly contradicts the 'Information Disclosure' tag, which would require a confidentiality impact (C:L/H); treat that tag as erroneous and the issue as a DoS. No EPSS score, no CISA KEV listing, and no POC were supplied, and the vulnerabilities were internally discovered by Cisco rather than reported from the wild, so there is no signal of active or imminent exploitation. SSVC-style reading: exploitation = none observed, technical impact = partial (availability only), automatable = likely (unauthenticated AV:N/AC:L), but the absence of exploit code and the generic grouping under CWE-664 lower real-world urgency. Net: a genuine remote-DoS to patch on exposed Meraki/Campus Gateway devices, but not an emergency relative to code-execution or in-the-wild-exploited CVEs. Key caveat: because CVE-2026-76467 groups 'multiple internally discovered vulnerabilities,' the single CVSS vector may not represent every bundled issue - verify specifics against the Cisco advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted network traffic to an exposed Meraki MX/MR/MV or Campus Gateway device, triggering an improper resource-lifetime condition (e.g. resource exhaustion, use-after-free, or leak) that crashes or hangs the service and disrupts connectivity. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, though impact is limited to availability. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) affecting Cisco Meraki MX security appliances, MR wireless access points, MV camera firmware, and Cisco Campus Gateway Software. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), the impact is availability-only - an unauthenticated remote attacker who can reach the affected service can trigger resource mismanagement that crashes or degrades the device, with no confidentiality or integrity loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Cisco has not published a specific patched firmware version in the CVE metadata, so administrators should consult the linked advisory to map the hardening release to their exact hardware and firmware train.
RemediationAI
Cisco has released a software hardening update that addresses the CWE-664 issues tracked by CVE-2026-76467; because the advisory bundles multiple internally discovered defects, there is no single named fix version in the CVE data, so administrators must consult https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH to identify the minimum fixed firmware for each affected platform and then upgrade Cisco Campus Gateway Software and Meraki MX, MR, and MV firmware to that release (Meraki appliances are typically updated through Dashboard-hosted firmware scheduling, which allows staged rollout). Until upgrades can be completed, the effective compensating controls are exposure-reduction measures, since the flaw is only reachable by a remote attacker who can touch the vulnerable service: restrict administrative and management-plane access to a dedicated out-of-band or management VLAN and block it from untrusted networks or the public internet, and segment IoT/guest networks away from device management interfaces - the trade-off is that remote administration and Dashboard API access from untrusted networks must be given up or brokered through a VPN/jump host. Additionally, apply ACLs or upstream firewall rules that limit which hosts may reach the affected services on MX, MR, MV, and Campus Gateway devices, accepting that legitimate monitoring or integration traffic from disallowed sources will break, and monitor device logs and Dashboard alerts for unexpected reboots, reloads, or resource-exhaustion events so that any exploitation attempt is detected quickly. Note that these are mitigations, not fixes, and that disabling individual features without vendor guidance may disrupt the very services the hardening release is intended to protect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-664 is a class-level (Pillar) weakness describing improper control of a resource through its lifetime - it is the parent of more concrete flaws such as CWE-404 (Improper Resource Shutdown or Release), CWE-772 (Missing Release of Resource after Effective Lifetime), CWE-400 (Uncontrolled Resource Consumption), and memory-lifetime defects like use-after-free. The unifying theme is that a resource (memory, file handle, session, table entry, queue) is acquired, used, or released incorrectly, so that repeated or specially crafted operations leave the system in an inconsistent state. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with that class: low complexity, no authentication, no user interaction, and a high availability-only impact, i.e. a remotely reachable service on the device can be driven into a crash or exhaustion condition that takes the device offline without exposing or altering data. CPE data confirms the exposure surface spans four distinct firmware lines - Cisco Campus Gateway Software and the Meraki MX (security/SD-WAN appliance), MR (wireless access point), and MV (camera) firmware families - so the same hardening effort addresses comparable lifetime-management defects across multiple code bases rather than a single product. Because the advisory aggregates several internally found issues without naming the triggering protocol, feature, or affected firmware revisions, the specific vulnerable component cannot be identified from public data alone; the 'Information Disclosure' tag attached to this CVE is not corroborated by the assessed vector, which reports no confidentiality impact, and should be treated as a tagging artifact rather than evidence of a data-exposure vector.
Know when Cisco Campus Gateway Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-664 resource-lifetime flaw reachable over the network without auth or interaction, causing availability loss only (C:N/I:N/A:H); mirrors vendor vector given no contradicting detail.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76467 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.
Executive ViewAI
Cisco Meraki MX security appliances, MR wireless access points, MV camera firmware, and Cisco Campus Gateway Software are affected by a high-severity availability vulnerability that allows unauthenticated remote attackers to crash or degrade devices. This could disrupt network connectivity, physical security monitoring, and campus operations, affecting productivity and safety. Leadership should prioritize mitigation because these devices are critical to organizational infrastructure and a successful attack could cause widespread service outages.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to device management interfaces via firewall rules, segmenting affected devices into isolated VLANs, enabling rate limiting or intrusion prevention to block anomalous traffic, and monitoring device availability for crashes or degradation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Adjacent-network buffer management flaws in Cisco Meraki OS let an unauthenticated attacker within Layer 2 or wireless r
Incorrect-calculation flaws in Cisco's hardening release for Meraki MR wireless access points, MV cameras, MX security a
Improper access control in Cisco Meraki firmware - spanning MR wireless access point software, MX security appliance fir
Authenticated attackers who already hold low-privileged access to a local or management interface of Cisco Meraki MR wir
Improper input validation in Cisco Meraki MR wireless access point, MV camera, and MX security appliance firmware - toge
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gat
Exploit-DB