Threat database

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.  

CVE-2026-76486 is a critical stack-based buffer overflow vulnerability in the VXLAN OAM (NGOAM) feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to send crafted packets to an IP interface on an affected device, potentially leading to arbitrary code execution with root privileges or causing a denial-of-service condition due to process crashes and device reloads.

CVE-2026-76488 is a medium severity vulnerability in Cisco Application Policy Infrastructure Controller (APIC) involving insufficient access control in the export policies functionality. An authenticated attacker with valid administrative credentials can exploit this flaw by submitting crafted values in UI fields to access sensitive files on the device's underlying file system. This includes key materials that could enable privilege escalation to root on the APIC and managed switches.

CVE-2026-76484 is a high-severity vulnerability in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) involving improper control of code generation, specifically code injection weaknesses. The issue was identified during an internal security review and relates to insufficient protections against code injection (CWE-94). The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability. Multiple specific versions of Cisco License On-Prem are affected. No public exploits are known, and no patch or remediation details are provided in the available data.

CVE-2026-76485 is a critical stack-based buffer overflow vulnerability in the VXLAN OAM (NGOAM) feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to send crafted packets to an IP interface, potentially leading to arbitrary code execution with root privileges or causing a denial-of-service by crashing processes and reloading the device.

CVE-2026-76483 is a critical vulnerability in Cisco License On-Prem related to insufficiently protected credentials. The issue falls under CWE-522, indicating weak protection of credentials. Cisco identified these vulnerabilities during an internal security review and released software hardening updates to address them. The vulnerability has a high CVSS score of 9.1, reflecting its critical impact on confidentiality and integrity without requiring privileges or user interaction. Multiple specific versions of Cisco License On-Prem are affected. There is no indication of known exploits in the wild, and the product is not a cloud service.

CVE-2026-76482 is a critical vulnerability in Cisco License On-Prem related to improper verification of cryptographic signatures. It involves improper input verification issues classified under CWE-347. The vulnerability allows an attacker to fully compromise confidentiality, integrity, and availability without requiring privileges or user interaction. Multiple versions of Cisco License On-Prem are affected. There is no explicit patch information provided in the input data.

CVE-2026-76480 is a critical vulnerability in Cisco License On-Prem related to missing authentication for critical functions. It was identified during an internal security review by Cisco's engineering team and involves improper authentication issues classified under CWE-306. The vulnerability has a high CVSS score of 9.8, indicating it allows unauthenticated remote attackers to fully compromise confidentiality, integrity, and availability. Multiple specific versions of Cisco License On-Prem are affected. No explicit patch or remediation details are provided in the input data.

CVE-2026-76458 is a high-severity vulnerability in Cisco NX-OS Software involving improper handling of exceptional conditions. This issue is categorized under CWE-703 and was identified through Cisco's internal security review. The vulnerability can cause a denial of service (availability impact) without affecting confidentiality or integrity. No specific affected versions or patch information are provided in the available data.

CVE-2026-76459 is a critical vulnerability in Cisco NX-OS Software involving out-of-bounds write issues. These flaws were discovered during an internal security review by Cisco's engineering team and are categorized under CWE-787. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No specific affected versions or patch information are provided in the available data.

CVE-2026-76471 is a critical heap-based buffer overflow vulnerability in the NX-API feature of Cisco NX-OS Software. It allows an unauthenticated remote attacker to send crafted HTTP requests to the NX-API, potentially leading to arbitrary code execution with root privileges or denial of service via device reloads.

CVE-2026-76455 is a critical vulnerability in Cisco NX-OS Software involving improper access control. Cisco identified this issue during an internal security review and addressed it through a software hardening release. The vulnerability is classified under CWE-284, indicating weaknesses in access control mechanisms. It has a high CVSS score of 9.8, reflecting its potential impact on confidentiality, integrity, and availability without requiring user interaction or privileges. No specific affected versions or patch details are provided in the available data.