Cisco Meraki Security Hardening Release October 2026

Cisco has released Meraki software updates that fix seven CVE groups, and the advisory is rated Critical. There are no workarounds, so upgrading is the only fix. Start with the table below, then check your fleet.

What Cisco fixed in the Meraki hardening release

Cisco's engineering teams ran an internal security review and found multiple vulnerabilities. The fixes ship as software hardening releases. The advisory ID is cisco-sa-hardening-meraki-os-drbEX9GH. Cisco first published it on 2026 October 7 and last updated it on 2026 November 9 (version 1.3, Final).

Cisco grouped the issues by weakness class (CWE) and gave each group one CVE ID. That is why you see seven CVEs instead of a long list. The flaws were found in internal testing. Cisco used existing processes and frontier AI models. Details are in the Cisco advisory.

Affected vs fixed Meraki software versions

The flaws affect these products regardless of device configuration:

• Campus Gateways

• Meraki MG Cellular Gateways

• Meraki MR Wireless Access Points

• Meraki MS Series Switches

• Meraki MV Smart Cameras

• Meraki MX Security and SD-WAN Appliances

This table lists the first fixed release for each software train, as Cisco documents it.

Cloud-configured Catalyst devices are covered elsewhere. You manage them through the Meraki Dashboard. For those, Cisco points to its separate advisory, Cisco IOS XE Software Security Hardening Release: August 2026.

The Campus Gateway 33.1.4 fix is listed as mid-November 2026. Confirm its availability in the advisory before you plan that upgrade.

How serious the seven CVEs are

The highest base score is 9.6, for CVE-2026-76464. The vector below is the one Cisco publishes for that top score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory does not list a separate vector for each of the other CVEs. Do not assume they share it.

In plain terms, an attacker on an adjacent network needs no privileges and no user action. A successful attack can change scope and hit confidentiality, integrity and availability.

Cisco says each score is the maximum severity of the single worst flaw inside that group.

On exploitation, Cisco PSIRT is not aware of any public announcements or malicious use. The issues were found internally and are not known to be actively exploited. That lowers urgency a little. Still, a 9.6 with no workaround belongs in your next patch window.

What to do now: patch order and checks

Follow these steps.

1. Export an inventory of every Meraki model and firmware version.

2. Match each device to its train in the table above.

3. Upgrade edge devices first: MX appliances, then MR access points and MS switches. This order is our suggestion, not Cisco's. Cisco gives no patch order. We put these first because they commonly sit closest to untrusted traffic. Cisco says all listed products are affected regardless of configuration.

4. Schedule MG, MV and Campus Gateway upgrades next.

5. Re-export the inventory and confirm every device meets the first fixed release.

You can pull the inventory with the Meraki Dashboard API. First list your organizations:

export MERAKI_API_KEY="your-key"
curl -s -L -H "X-Cisco-Meraki-API-Key: $MERAKI_API_KEY" \
  "https://api.meraki.com/api/v1/organizations" | jq -r '.[] | [.id, .name] | @csv'

Then list devices with model and firmware for one organization:

curl -s -L -H "X-Cisco-Meraki-API-Key: $MERAKI_API_KEY" \
  "https://api.meraki.com/api/v1/organizations/ORG_ID/devices?perPage=1000" \
  | jq -r '.[] | [.model, .name, .firmware] | @csv'

If you have more than 1000 devices, follow the pagination links in the response headers. The API may format firmware strings differently. They can differ from the advisory's version numbers. Cross-check with the Dashboard firmware page. Use a read-only API key for this audit.

Worked example: reading your own firmware list

Say your export shows three devices. These are made-up values to show the method.

The rule is simple. Find the train, then compare your build to the first fixed release. Watch the footnotes. 31.1.8.1 applies only to MR45/55. 30.7.3 applies only to the Wi-Fi 5 Wave 2 family. If your model is not named in a footnote, do not assume that release applies to it.

What IT and security learners can take from this

This advisory shows how vendors now triage large batches of bugs. Grouping by CWE, scoring by worst case, and publishing a fixed-release table is a pattern you will meet again. Practice turning an advisory into an asset inventory, a version comparison and a verification step.

These are core skills for analyst roles. The CompTIA CySA+ CS0-003 voucher covers vulnerability management in that spirit. For more current threats, see our 5 active cyber threats facing US enterprises.

Sources

• Cisco Meraki Security Hardening Release: October 2026 (cisco-sa-hardening-meraki-os-drbEX9GH)