cisco-sa-notice-fBn58ELx: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories
On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables.To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.Cisco NX-OS SoftwareCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco NX-OS Software Security Hardening Release: October 2026CVE-2026-76455CVE-2026-76456CVE-2026-76457CVE-2026-76459CVE-2026-76458CVE-2026-76453Critical9.8Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution VulnerabilityCVE-2026-76465Critical9.8Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution VulnerabilitiesCVE-2026-76485CVE-2026-76486CVE-2026-76501Critical9.8Cisco NX-OS Software NX-API Remote Code Execution VulnerabilityCVE-2026-76471Critical9.8Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass VulnerabilityCVE-2026-20038Medium5.8Cisco NX-OS Software Control Plane Denial of Service VulnerabilityCVE-2026-20173Medium5.8Cisco NX-OS Software Python Sandbox Escape VulnerabilityCVE-2026-20032Medium4.4Cisco Application Policy Infrastructure ControllerCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco Application Policy Infrastructure Controller Security Hardening Release: October 2026CVE-2026-76499CVE-2026-76500CVE-2026-76498Critical9.8Cisco Application Policy Infrastructure Controller API Command Injection VulnerabilityCVE-2026-20321Medium6.5Cisco Application Policy Infrastructure Controller Unauthorized File Access VulnerabilityCVE-2026-76488Medium6.5Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and FinesseCisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026CVE-2026-76480CVE-2026-76482CVE-2026-76483CVE-2026-76484Critical10.0Cisco License (Smart Software Manager) On-Prem VulnerabilitiesCVE-2026-76437CVE-2026-76452CVE-2026-20328CVE-2026-76454Critical10.0Cisco Meraki Security Hardening Release: October 2026CVE-2026-76470CVE-2026-76472CVE-2026-76469CVE-2026-76464CVE-2026-76467CVE-2026-76468CVE-2026-76463Critical9.6Cisco Finesse Server-Side Request Forgery VulnerabilityCVE-2026-20362High7.2
Affected Software
Event History
Frequently Asked Questions
Are fixed software releases available yet?
No. Cisco states that fixed software releases will be identified in advisories published on October 7, 2026.
Which environments should be reviewed when the advisories are published?
Review deployments using Cisco Application Policy Infrastructure Controller, Finesse, License On-Prem, Meraki, and NX-OS Software on the listed MDS 9000, Nexus 3000, 7000, and 9000 Series switches, Nexus 9000 in ACI mode, and UCS Fabric Interconnects.
What should teams do before patch guidance is released?
Identify affected product deployments and prepare to review the October 7, 2026 advisories. The notice does not provide vulnerability-specific mitigations or configuration workarounds.