Cisco released critical security updates addressing 35 vulnerabilities across core enterprise networking products, including maximum-severity flaws in License On-Prem and root-execution bugs in Nexus switches. The October 2026 patches require immediate administrative upgrades as administrators face zero available workarounds for the most dangerous system risks.
Administrators managing enterprise infrastructure face an urgent patch cycle following a major security disclosure from Cisco. The vendor issued fixes for 35 distinct vulnerabilities spanning multiple widely deployed product lines, more than a dozen of which carry critical severity ratings.
Affected environments include enterprise switches, data-center hardware, and internal licensing management platforms. While the hardware manufacturer reports no evidence of active malicious exploitation in the wild, the severity of the flaws and the total absence of manual workarounds mean networks remain exposed until software upgrades are fully applied.
License On-Prem Flaws Trigger Maximum CVSS Severity Ratings
One core hardening advisory carries a maximum CVSS score of 10.0, the highest possible threat rating. Tracked as CVE-2026-76482, the flaw stems from improper verification of cryptographic signatures. It features a network-based attack vector requiring no user interaction and no prior authentication.
The most dangerous weaknesses identified in the security batch center on Cisco License On-Prem, the platform previously known as Cisco Smart Software Manager On-Prem. This software allows organizations to manage product licenses internally rather than depending on cloud-based validation.
- CVE-2026-76480 (CVSS 9.8): Missing authentication for a critical function, allowing unauthorized access.
- CVE-2026-76483 (CVSS 9.1): Insufficient protection of credentials, risking sensitive data exposure.
- CVE-2026-76484 (CVSS 8.8): Improper control of code generation that can enable code injection.
- CVE-2026-20328: An arbitrary account password-reset vulnerability permitting unauthorized access.
Cisco credited Gabriele Paris of the NATO Cyber Security Centre with reporting CVE-2026-20328, along with command-injection and SQL-injection flaws tracked as CVE-2026-76437 and CVE-2026-76452. Trung Nguyen of CyStack reported an unauthenticated API vulnerability, CVE-2026-76454, which can trigger file writes or denial-of-service conditions.
Nexus Switches Exposed to Unauthenticated Root-Level Code Execution
Data-center infrastructure running Cisco NX-OS faces severe risks from vulnerabilities discovered in the NGOAM feature. Multiple flaws in NGOAM allow unauthenticated attackers to transmit specially crafted network traffic toward a vulnerable device.
A successful exploit can trigger arbitrary code execution with root privileges or cause remote system crashes resulting in denial-of-service conditions. These networking weaknesses affect the Nexus 3000 and Nexus 9000 series.
According to reports from security analysts at Heise, the prerequisite for exploitation is that the NGOAM or MPLS OAM function must be enabled on the device, though MPLS OAM remains deactivated by default.
Cisco Patches Three Critical Vulnerabilities in APIC
The Application Policy Infrastructure Controller, or APIC, which serves as the central management engine for Cisco Application Centric Infrastructure environments, received patches for three critical vulnerabilities. Tracked as CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, these flaws involve access control failures, command injection, and memory management errors.
Each APIC defect carries a CVSS score of 9.8. Cisco confirmed that affected APIC installations remain vulnerable regardless of their configuration parameters, leaving software upgrades as the only viable remediation path.
The vendor also patched a flaw in Cisco Finesse, for which updates are scheduled for release in January and February 2027.
AI Models Aid Internal Vulnerability Discovery Processes
Company engineering teams identified a portion of the newly fixed flaws using traditional security testing paired with AI models.
Administrators must carefully verify installed versions against Cisco’s published advisories, as older installations running legacy software versions will require complete platform migration rather than routine update packages.