Cisco October 2026 hardening spans NX-OS, Meraki and more

Cisco’s October 2026 hardening updates, flagged by Canada’s Cyber Centre, cover NX-OS, Meraki, Nexus, UCS, APIC and contact-center software, with no known exploitation.

On 7 October 2026, Cisco published separate October 2026 security hardening releases for NX-OS software and for Meraki products. In both cases Cisco said multiple vulnerabilities were found during internal testing or an internal security review and are not known to be actively exploited. The issues were grouped by weakness class (CWE), with one CVE identifier assigned to each class or grouping, and software updates were released; the source excerpts do not list the specific CVE identifiers. On 8 October 2026, the Canadian Centre for Cyber Security issued alert AV26-1020 covering Cisco vulnerabilities in Nexus 3000 and 9000 switches, UCS fabric interconnects, multiple Meraki products, NX-OS, APIC, and contact-center software including Finesse, CCE, and CCX. Fixed releases are listed for several products, with some Meraki updates scheduled into late 2026 and contact-center fixes extending into early 2027. The Canadian alert names no CVE identifiers and does not report exploitation, which is consistent with Cisco’s statements on the NX-OS and Meraki issues; the reports do not otherwise disagree.

• On 7 October 2026 Cisco published separate October 2026 security hardening releases for NX-OS software and Meraki products.
• Cisco said the flaws were found in internal testing or an internal security review and are not known to be actively exploited.
• Issues were grouped by weakness class (CWE), with one CVE identifier per class or grouping; the excerpts do not list those CVE identifiers, and software updates were released.
• Canadian Centre for Cyber Security alert AV26-1020, dated 8 October 2026, names Nexus 3000 and 9000 switches, UCS fabric interconnects, multiple Meraki products, NX-OS, APIC, and contact-center software including Finesse, CCE, and CCX.
• Fixed releases are listed for several products; some Meraki updates are scheduled for late 2026 and contact-center fixes extend into early 2027.
• AV26-1020 gives no CVE identifiers, does not report exploitation, and tells administrators to review Cisco’s advisories and apply updates as they become available.