Cisco vulnerabilities, week 41 of 2026: unauthenticated NX-OS, Splunk and License On-Prem flaws lead 59 CVEs

The release at a glance

Cisco published 59 CVEs for week 41 of 2026, covering 5 October to 11 October 2026. The severity split is 18 critical, 15 high, 25 medium and 1 unscored. Products with the most entries are Splunk Enterprise (22), Cisco NX-OS Software (13), Cisco License On-Prem (8), Cisco Campus Gateway Software (7) and Cisco Application Policy Infrastructure Controller (APIC) (5). Smaller numbers affect Cisco Finesse, Cisco NX-OS System Software in ACI Mode, Splunk MCP Server and Jabber for Android. No CVE in this release is listed in CISA KEV. Cisco PSIRT says it is not aware of public announcements or malicious use of the vulnerabilities covered by its NX-OS, License On-Prem and APIC advisories. Several of the critical items are unauthenticated, network-reachable remote code execution or hardening issues in NX-OS, Splunk Enterprise and License On-Prem, which sets the prioritisation for this week.

What matters most

Splunk Enterprise. CVE-2026-76268 is a missing authentication flaw in the Patroni REST API on search head cluster members. An unauthenticated user with network access to the interface could execute operating-system commands. Splunk Enterprise 10.0.x and 9.4.x are not affected; fixed versions are 10.4.3 and 10.2.7. CVE-2026-76284 is a critical improper neutralisation group, fixed in 10.4.3, 10.2.7, 10.0.10 and 9.4.15. Both are rated CVSS 9.8 with a network attack vector, no privileges and no user interaction.

Cisco NX-OS Software. CVE-2026-76471 is unauthenticated remote code execution or denial of service through the NX-API. CVE-2026-76465 is remote code execution or denial of service through MPLS OAM on Nexus 3000 and 9000 Series switches. CVE-2026-76485 and CVE-2026-76486 are remote code execution or denial of service through VXLAN OAM (NGOAM). All are CVSS 9.8, require no privileges and no user interaction, and an attacker with network access could run code with root privileges or force a reload. Separate NX-OS hardening advisories cover improper access control and out-of-bounds writes.

Cisco License On-Prem. CVE-2026-76482, rated CVSS 10, covers improper input verification. CVE-2026-76480, rated CVSS 9.8, covers improper authentication. Both are part of the October 2026 security hardening release for the product formerly known as Smart Software Manager On-Prem.

Cisco APIC. The October 2026 APIC hardening release includes critical network-reachable improper access control and improper neutralisation vulnerabilities; the table on this page lists the relevant CVE entries.

Patch in this order

1. Start with Splunk Enterprise search head cluster members. For CVE-2026-76268, upgrade affected 10.4 and 10.2 releases to 10.4.3 or 10.2.7; Splunk Enterprise 10.0.x and 9.4.x are not affected. For CVE-2026-76284, upgrade affected trains to 10.4.3, 10.2.7, 10.0.10 or 9.4.15. Prioritise systems where the Patroni REST API or search head cluster management interface is reachable from untrusted networks.
2. Patch Cisco NX-OS devices with NX-API, MPLS OAM or VXLAN OAM enabled, especially Nexus 3000 and 9000 Series switches. The relevant advisories cover CVE-2026-76471, CVE-2026-76465, CVE-2026-76485 and CVE-2026-76486. These are unauthenticated, remote code execution or denial of service flaws; confirm the appropriate fixed version for your train in each Cisco advisory.
3. Upgrade Cisco License On-Prem, formerly Smart Software Manager On-Prem, to the October 2026 security hardening release. This addresses CVE-2026-76482 and CVE-2026-76480, which affect the older version lines listed in the advisory.
4. Apply the October 2026 APIC hardening release to affected Cisco Application Policy Infrastructure Controller deployments.
5. Then work through the remaining high- and medium-severity items, led by exposed Cisco Campus Gateway Software and the Splunk Enterprise medium-severity cluster, according to your exposure management data.

Beyond the patch

A release dominated by unauthenticated, network-reachable flaws is best managed by knowing which management planes, APIs and cluster interfaces are actually reachable before patch day. Virtual CISO Services (vCISO) builds that exposure view and the patching order. Should any of these flaws be exploited, code execution, privileged account activity and unusual process behaviour leave telemetry that Managed Detection & Response (MDR) is built to detect and respond to.