Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-76530

Non-canonical URL authorization flaw in Cisco software

CVSS 3.1
8.8 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-76530 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

CVE-2026-76530 covers use of non-canonical URL paths when making authorization decisions (CWE-647), found in a Cisco internal review and addressed in a software hardening release. A remote attacker with low privileges can trigger it over the network with no user interaction and can fully affect confidentiality, integrity, and availability. Cisco has not named the product or builds in this record.

What to do: Apply Cisco's software hardening update that addresses CVE-2026-76530. No fixed version or workaround is stated.

Description · NVD

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.

Weakness
CWE-647
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story