A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
This is an advance notification from Cisco about the scheduled publication of security advisories on October 21, 2026. It informs customers about the regular cadence of security vulnerability disclosures under Cisco's risk-based disclosure process, which typically occur on the first and third Wednesday of each month. The notice clarifies that the schedule is tentative and subject to change, with potential additions or removals of advisories depending on readiness. No specific vulnerabilities or threats are detailed in this notification.
CVE-2015-5477 is a vulnerability in ISC BIND that causes data processing errors when handling TKEY DNS resource record requests. This flaw can lead to a denial of service by causing the BIND DNS server (named) to exit unexpectedly due to an assertion failure triggered by specially crafted DNS queries. The vulnerability affects multiple Red Hat Enterprise Linux versions, and patches have been released to address the issue. Exploitation in the wild has been observed.
CVE-2026-76472 is a high-severity vulnerability in Cisco Campus Gateway Software involving improper neutralization of special elements in output used by downstream components, categorized as an injection issue. It affects numerous specific versions of the software. The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
CVE-2026-76467 is a high-severity vulnerability in Cisco Campus Gateway Software involving improper control of a resource through its lifetime. The issue was identified during Cisco's internal security review and is classified under CWE-664. The vulnerability does not impact confidentiality or integrity but can cause a denial of service due to availability impact. It affects multiple specific versions of Cisco Campus Gateway Software. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the input data.
CVE-2026-76470 is a high-severity vulnerability in Cisco Campus Gateway Software involving incorrect calculation issues. These issues fall under the Common Weakness Enumeration category CWE-682. The vulnerability affects numerous specific versions of the software. It has a CVSS 3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. There is no explicit information about patches or remediation in the provided data.
CVE-2026-76469 is a high-severity vulnerability in Cisco Campus Gateway Software involving insufficient control flow management. It affects numerous specific versions of the software. The vulnerability does not impact confidentiality or integrity but results in a high impact on availability. No known exploits are reported in the wild.
CVE-2026-76468 is a high-severity vulnerability in Cisco Campus Gateway Software caused by improper input validation. It affects numerous specific versions of the software. The flaw does not impact confidentiality but can lead to integrity and availability issues. There are no known exploits in the wild. The vulnerability was identified through Cisco's internal security review and is part of a software hardening effort.
CVE-2026-76464 is a critical vulnerability in Cisco Campus Gateway Software involving improper restriction of operations within the bounds of a memory buffer, classified under CWE-119. This vulnerability was identified during an internal security review by Cisco and affects numerous specific versions of the software. The CVSS 3.1 base score is 9.6, indicating a critical severity with high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild. The vulnerability is not related to a cloud service and no patch or remediation details are provided in the input data.
CVE-2026-76463 is a high-severity vulnerability in Cisco Campus Gateway Software involving improper access control. It was identified through an internal security review by Cisco and affects multiple specific versions of the software. The vulnerability has a CVSS 3.1 score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Cisco has released a software hardening update addressing this and other internally discovered issues.
CVE-2026-76501 is a critical stack-based buffer overflow vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to execute arbitrary code with root privileges or cause a denial of service by sending crafted packets to an IP interface on an affected device. The flaw arises from improper input validation when NGOAM and SRv6 features are enabled.
CVE-2026-76500 is a critical vulnerability in Cisco Application Policy Infrastructure Controller (APIC) involving improper control of a resource through its lifetime. This issue was discovered during an internal security review by Cisco and relates to CWE-664. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability without requiring privileges or user interaction.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76498 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.