Threat database

CVE-2026-76470 is a high-severity vulnerability in Cisco Campus Gateway Software involving incorrect calculation issues. These issues fall under the Common Weakness Enumeration category CWE-682. The vulnerability affects numerous specific versions of the software. It has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. There is no explicit information about patches or remediation in the provided data.

CVE-2026-76469 is a high-severity vulnerability in Cisco Campus Gateway Software involving insufficient control flow management. It affects numerous specific versions of the software. The vulnerability does not impact confidentiality or integrity but results in a high impact on availability. No known exploits are reported in the wild.

CVE-2026-76468 is a high-severity vulnerability in Cisco Campus Gateway Software caused by improper input validation. It affects numerous specific versions of the software. The flaw does not impact confidentiality but can lead to integrity and availability issues. There are no known exploits in the wild. The vulnerability was identified through Cisco's internal security review and is part of a software hardening effort.

CVE-2026-76464 is a critical vulnerability in Cisco Campus Gateway Software involving improper restriction of operations within the bounds of a memory buffer, classified under CWE-119. This vulnerability was identified during an internal security review by Cisco and affects numerous specific versions of the software. The CVSS 3.1 base score is 9.6, indicating a critical severity with high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild. The vulnerability is not related to a cloud service and no patch or remediation details are provided in the input data.

CVE-2026-76463 is a high-severity vulnerability in Cisco Campus Gateway Software involving improper access control. It was identified through an internal security review by Cisco and affects multiple specific versions of the software. The vulnerability has a CVSS 3.1 score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing this and other internally discovered issues.

CVE-2026-76501 is a critical stack-based buffer overflow vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an IP interface on an affected device. The flaw arises from improper input validation when NGOAM and SRv6 features are enabled.

CVE-2026-76500 is a critical vulnerability in Cisco Application Policy Infrastructure Controller (APIC) involving improper control of a resource through its lifetime. This issue was discovered during an internal security review by Cisco and relates to CWE-664. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.  

CVE-2026-76486 is a critical stack-based buffer overflow vulnerability in the VXLAN OAM (NGOAM) feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to send crafted packets to an IP interface on an affected device, potentially leading to arbitrary code execution with root privileges or causing a denial-of-service condition due to process crashes and device reloads.

CVE-2026-76488 is a medium severity vulnerability in Cisco Application Policy Infrastructure Controller (APIC) involving insufficient access control in the export policies functionality. An authenticated attacker with valid administrative credentials can exploit this flaw by submitting crafted values in UI fields to access sensitive files on the device's underlying file system. This includes key materials that could enable privilege escalation to root on the APIC and managed switches.

CVE-2026-76484 is a high-severity vulnerability in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) involving improper control of code generation, specifically code injection weaknesses. The issue was identified during an internal security review and relates to insufficient protections against code injection (CWE-94). The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability. Multiple specific versions of Cisco License On-Prem are affected. No public exploits are known, and no patch or remediation details are provided in the available data.

A critical vulnerability exists in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM. This flaw allows an unauthenticated remote attacker to send crafted packets to an affected device, potentially leading to arbitrary code execution with root privileges or causing a denial-of-service (DoS) condition due to process crashes and device reloads.