Ce mail provient de l'extérieur, restons vigilants ===================================================================== CERT-Renater Note d'Information No. 2026/VULN983 _____________________________________________________________________ DATE : 07/10/2026 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Cisco Application Policy Infrastructure Controller software, Cisco Nexus 3000 and 9000 Series Switches software, Cisco License (Smart Software Manager), Cisco NX-OS Software, Cisco Meraki, Cisco Finesse, Cisco Application Policy Infrastructure Controller, Cisco Nexus 9000 Series Fabric Switches. ==================================================================== https://sec.cloudapps.cisco.com/security/center/publicationListing.x _____________________________________________________________________ Below is the list of Cisco Security Advisories published by Cisco PSIRT on 2026-October-07. The following PSIRT security advisories (8 Critical, 1 High, 5 Medium) were published at 16:00 UTC today. Table of Contents: 1) Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026 - SIR: Critical 2) Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities - SIR: Critical 3) Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026 - SIR: Critical 4) Cisco NX-OS Software NX-API Remote Code Execution Vulnerability - SIR: Critical 5) Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability - SIR: Critical 6) Cisco Meraki Security Hardening Release: October 2026 - SIR: Critical 7) Cisco NX-OS Software Security Hardening Release: October 2026 - SIR: Critical 8) Cisco License (Smart Software Manager) On-Prem Vulnerabilities - SIR: Critical 9) Cisco Finesse Server-Side Request Forgery Vulnerability - SIR: High 10) Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability - SIR: Medium 11) Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability - SIR: Medium 12) Cisco NX-OS Software Control Plane Denial of Service Vulnerability - SIR: Medium 13) Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability - SIR: Medium 14) Cisco NX-OS Software Python Sandbox Escape Vulnerability - SIR: Medium +-------------------------------------------------------------------- 1) Cisco Application Policy Infrastructure Controller Security Hardening Release: October 2026 CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-apic-UOXWtfh"] +-------------------------------------------------------------------- 2) Cisco Nexus 3000 and 9000 Series Switches NGOAM Remote Code Execution Vulnerabilities CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU"] +-------------------------------------------------------------------- 3) Cisco License (Smart Software Manager) On-Prem Security Hardening Release: October 2026 CVE-2026-76480, CVE-2026-76482, CVE-2026-76483, CVE-2026-76484 SIR: Critical CVSS Score v(3.1): 10.0 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-ssm-Ph77wdhf"] +-------------------------------------------------------------------- 4) Cisco NX-OS Software NX-API Remote Code Execution Vulnerability CVE-2026-76471 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j"] +-------------------------------------------------------------------- 5) Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability CVE-2026-76465 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7"] +-------------------------------------------------------------------- 6) Cisco Meraki Security Hardening Release: October 2026 CVE-2026-76463, CVE-2026-76464, CVE-2026-76467, CVE-2026-76468, CVE-2026-76469, CVE-2026-76470, CVE-2026-76472 SIR: Critical CVSS Score v(3.1): 9.6 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-meraki-os-drbEX9GH"] +-------------------------------------------------------------------- 7) Cisco NX-OS Software Security Hardening Release: October 2026 CVE-2026-76453, CVE-2026-76455, CVE-2026-76456, CVE-2026-76457, CVE-2026-76458, CVE-2026-76459 SIR: Critical CVSS Score v(3.1): 9.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-nxosw1-cWzSbtR"] +-------------------------------------------------------------------- 8) Cisco License (Smart Software Manager) On-Prem Vulnerabilities CVE-2026-20328, CVE-2026-76437, CVE-2026-76452, CVE-2026-76454 SIR: Critical CVSS Score v(3.1): 9.1 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-access-nttb2dhE"] +-------------------------------------------------------------------- 9) Cisco Finesse Server-Side Request Forgery Vulnerability CVE-2026-20362 SIR: High CVSS Score v(3.1): 7.2 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS"] +-------------------------------------------------------------------- 10) Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability CVE-2026-76488 SIR: Medium CVSS Score v(3.1): 6.5 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-info-priv-enAdB5vD"] +-------------------------------------------------------------------- 11) Cisco Application Policy Infrastructure Controller API Command Injection Vulnerability CVE-2026-20321 SIR: Medium CVSS Score v(3.1): 6.5 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cmdinj-L6VR4E7 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cmdinj-L6VR4E7"] +-------------------------------------------------------------------- 12) Cisco NX-OS Software Control Plane Denial of Service Vulnerability CVE-2026-20173 SIR: Medium CVSS Score v(3.1): 5.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7 ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-nscpdos-SnderkC7"] +-------------------------------------------------------------------- 13) Cisco Nexus 9000 Series Fabric Switches in ACI Mode Endpoint Group Contract Bypass Vulnerability CVE-2026-20038 SIR: Medium CVSS Score v(3.1): 5.8 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-epgcbp-SfDU7NLf"] +-------------------------------------------------------------------- 14) Cisco NX-OS Software Python Sandbox Escape Vulnerability CVE-2026-20032 SIR: Medium CVSS Score v(3.1): 4.4 URL: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-mppe-dhKZAFgb"] ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================