Cisco Meraki CVE-2026-76464: Fixed Firmware for MX, MR and MS

Published 12 November 2026 · Rathish Kumar, Invitty

Cisco updated its Meraki security hardening advisory on 9 November 2026 with new fixed-firmware availability. The advisory covers seven CVEs found in Cisco's own testing, led by CVE-2026-76464 at CVSS 9.6, across MX, MR, MS, MG and MV devices and Campus Gateways, whatever their configuration. Cisco knows of no exploitation and offers no workaround. Schedule the fixed release in Dashboard now, such as MX 26.1.7 or MR 33.1.3.

What changed on 9 November

Cisco first published the advisory on 7 October and has revised it three times since. The 9 November revision, version 1.3, updated which fixed releases are available. With that, almost every Meraki line now has a firmware you can schedule, and this is the point where "we'll do it when the fix is out" stops being a reason to wait.

The advisory is unusual in how it groups bugs. Cisco bundled internally found issues by weakness type and gave each group a single CVE, scored by its worst member. So CVE-2026-76464 is not one bug but a family of buffer overflows and out-of-bounds writes. Others cover access control (8.8), integer errors (8.8), command injection (8.8), input validation and path traversal (8.2), resource handling (7.5) and race conditions (7.4). Cisco credits its internal testing together with frontier AI models for finding them.

The 9.6 score comes with an adjacent-network vector. An attacker needs to be on a segment connected to the device, not just anywhere on the internet. In an Indian office that usually means guest Wi-Fi, a shared floor LAN or an IoT VLAN with cameras and printers. Those are exactly the networks that tend to be loosely controlled.

Which firmware fixes each Meraki product line

Cisco lists the first fixed release per train. Anything at or above these versions has the fixes.

Two rows need care. The MS table pairs older releases with fixes on a newer train, which reads as an upgrade to 18.1.9 rather than a patch within 17.2. Confirm in Dashboard which version is offered for each switch model before you schedule. And the MV move from 7 to 8.0 is a major release for cameras, so check that your recording and retention settings come through intact on one camera before you roll it out to the rest.

"Cloud-managed" is not the same as "already patched"

The most common thing we hear from Meraki customers is that Cisco patches everything for them. Partly true. Cisco does schedule firmware upgrades, but Dashboard lets administrators delay them, and plenty of networks run with long deferrals because a past upgrade rebooted access points during working hours. Some MX appliances are pinned to older releases on purpose, for a VPN peer or a legacy app.

So check rather than assume. In Dashboard, go to Organization, then Firmware upgrades. The overview shows each network's current version and any scheduled upgrade. Our order for a typical customer:

1. MX appliances first, especially where guest Wi-Fi or a vendor network terminates on them. Schedule after hours, because the MX reboots and the site loses internet for a few minutes.
2. MR access points next, because guest SSIDs are the adjacent network an outsider can most easily join.
3. MS switches, MG and MV after that, in the next maintenance window.
4. Campus Gateways on 33.1 as soon as Cisco releases 33.1.4.

Until every device is on a fixed release, keep guest and IoT VLANs isolated from corporate and management networks. That does not remove the flaw, but it narrows who can reach it. Our Meraki wireless page covers how we usually lay out SSIDs and VLANs for offices.

Licences, Catalyst devices and the bigger picture

If you run Catalyst switches or access points through Meraki Dashboard, this advisory does not cover them. Cisco points those to its separate IOS XE security hardening release from August 2026, which has its own fixed versions. Our Cisco switching page lists the Catalyst and Meraki ranges we supply.

While you are in Dashboard, open the licensing page and note the expiry date. In our experience Indian customers rarely miss a Meraki firmware window because of the firmware itself. They miss it because the licence lapsed months ago and nobody can open a support case. Renewals for Meraki usually need a purchase order and a GST invoice lined up weeks ahead, and our renewals desk can quote against the licence end date you see there.

Cisco is not alone in shipping a large batch of AI-assisted findings at once. Fortinet and Palo Alto Networks both credited AI-assisted research in advisories they published this week. Expect bigger, lumpier patch releases from now on, and plan maintenance windows monthly rather than when something breaks.

Questions we are hearing about the Meraki advisory

Next step

Export the device inventory from Dashboard, or send us your organisation's network list, and we will mark each MX, MR, MS, MG and MV device that is below the fixed release, suggest a staged schedule, and check your licence end date. Our Cisco brand page covers the rest of what we deploy.

Sources

Facts in this post come from these pages, checked on the date of publication. Vendor advisories change, so check the advisory itself before you schedule work.

• Cisco security advisory: Meraki security hardening release (cisco-sa-hardening-meraki-os-drbEX9GH)