Search threats, CVEs… ⌘K
Back to vendor advisories
Cisco Security Advisoriescisco-sa-notice-fBn58ELx

Cisco Advance Notification for Publication of October 7, 2026, Security Advisories

35 CVEs Published Oct 7, 2026 at 4:00 PM UTC

14 advisories 35 CVEs 3 product groups

Get alerts for NX-OS Software

Summary

On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables.

To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.

For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the Foundation: A Predictable, Customer-Focused Response to AI-Accelerated Vulnerability Discovery.

Products covered

  • Cisco NX-OS Software

  • Cisco Application Policy Infrastructure Controller

  • Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and Finesse

7 advisories

Cisco NX-OS Software

  1. Cisco NX-OS Software Security Hardening Release: October 2026

    CriticalCVSS 9.8
    CVE-2026-76455CVE-2026-76456CVE-2026-76457CVE-2026-76459CVE-2026-76458CVE-2026-76453

  2. Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability

    CriticalCVSS 9.8
    CVE-2026-76465

  3. Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities

    CriticalCVSS 9.8
    CVE-2026-76485CVE-2026-76486CVE-2026-76501

  4. Cisco NX-OS Software NX-API Remote Code Execution Vulnerability

    CriticalCVSS 9.8
    CVE-2026-76471

  5. Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability

    MediumCVSS 5.8
    CVE-2026-20038

  6. Cisco NX-OS Software Control Plane Denial of Service Vulnerability

    MediumCVSS 5.8
    CVE-2026-20173

  7. Cisco NX-OS Software Python Sandbox Escape Vulnerability

    MediumCVSS 4.4
    CVE-2026-20032
3 advisories

Cisco Application Policy Infrastructure Controller

  1. Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026

    CriticalCVSS 9.8
    CVE-2026-76499CVE-2026-76500CVE-2026-76498

  2. Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability

    MediumCVSS 6.5
    CVE-2026-20321

  3. Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability

    MediumCVSS 6.5
    CVE-2026-76488
4 advisories

Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and Finesse

  1. Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026

    CriticalCVSS 10.0
    CVE-2026-76480CVE-2026-76482CVE-2026-76483CVE-2026-76484

  2. Cisco License (Smart Software Manager) On-Prem Vulnerabilities

    CriticalCVSS 10.0
    CVE-2026-76437CVE-2026-76452CVE-2026-20328CVE-2026-76454

  3. Cisco Meraki Security Hardening Release: October 2026

    CriticalCVSS 9.6
    CVE-2026-76470CVE-2026-76472CVE-2026-76469CVE-2026-76464CVE-2026-76467CVE-2026-76468CVE-2026-76463

  4. Cisco Finesse Server-Side Request Forgery Vulnerability

    HighCVSS 7.2
    CVE-2026-20362

Remediation

To remediate the vulnerabilities that were disclosed on October 7, 2026, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories.

CVEs in this advisory 35

CVE-2026-76455CVE-2026-76456CVE-2026-76457CVE-2026-76459CVE-2026-76458CVE-2026-76453CVE-2026-76465CVE-2026-76485CVE-2026-76486CVE-2026-76501CVE-2026-76471CVE-2026-20038CVE-2026-20173CVE-2026-20032CVE-2026-76499CVE-2026-76500CVE-2026-76498CVE-2026-20321CVE-2026-76488CVE-2026-76480CVE-2026-76482CVE-2026-76483CVE-2026-76484CVE-2026-76437CVE-2026-76452CVE-2026-20328CVE-2026-76454CVE-2026-76470CVE-2026-76472CVE-2026-76469CVE-2026-76464CVE-2026-76467CVE-2026-76468CVE-2026-76463CVE-2026-20362
Update history

What changed in later vendor updates

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

    • The vendor changed the advisory summary.
    • Severity changed from Unknown to Informational.
    • Added CVEs: CVE-2026-20321, CVE-2026-20328, CVE-2026-20362, CVE-2026-76437, CVE-2026-76452.
    • Added affected products: Cisco Application Policy Infrastructure Controller, Cisco NX-OS Software, Cisco Smart License (Smart Software Manager) On-Prem, Meraki, and Finesse.
    • Removed affected products: Cisco Advance Notification for Publication of October 7, 2026, Security Advisories.
    • The vendor changed the advisory summary.
    • Severity changed from Informational to Unknown.
    • Added CVEs: CVE-2026-20032, CVE-2026-20038, CVE-2026-20173, CVE-2026-76453, CVE-2026-76455.
    • The vendor changed its remediation guidance.

Updates

  1. Added to SecurityAlert

    We collected the advisory from the official source.

  2. Published by Cisco

    The publication date reported by the vendor.

  3. Confirmed at the source

    Our collector saw this advisory during a later source check.

Keep investigating
See every advisory from this vendor