CVE-2026-76472: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Cisco Cisco Campus Gateway Software

CVE-2026-76472 concerns improper neutralization of special elements in output within Cisco Campus Gateway Software, which can lead to injection attacks as classified under CWE-74. The vulnerability was discovered internally by Cisco's networking engineering team during a comprehensive security review. It affects multiple explicitly listed versions of the software. The CVSS 3.1 base score is 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in complete confidentiality, integrity, and availability impact. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with local access and low privileges to perform injection attacks that compromise confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 8.8. There are no reports of active exploitation in the wild.

Cisco has released software hardening updates that address this vulnerability as part of their internal security review process. Users should apply the official Cisco patches or updates corresponding to their affected software versions. Since this is not a cloud service, remediation depends on applying these updates. Patch status is not explicitly confirmed in the provided data; users should consult Cisco advisories for the latest remediation guidance.