CVE-2026-76530
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 relate to the use of non-canonical URL paths for authorization decisions (CWE-647).
Risk Assessment
Non-canonical URL paths in authorization decisions may allow bypassing access controls and reaching resources a user should not be permitted to access.
Recommendation
Apply the Cisco hardening release containing the fixes for CVE-2026-76530 as directed by the vendor.
Other vulnerabilities in Cisco
See all- CVE-2026-76531Critical
Cisco's internal security review discovered multiple vulnerabilities related to files or directories accessible to external parties (CWE-552). Fixes were released as part of a software hardening update.
- CVE-2026-76302Critical
Cisco's internal security review discovered multiple vulnerabilities related to improper neutralization (CWE-707). Fixes were released as part of a software hardening update.
- CVE-2026-76299Critical
Cisco conducted an internal security review resulting in a software hardening release. The vulnerabilities tracked by this CVE relate to improper access control and are classified under CWE-284.
- CVE-2026-76285Critical
As part of Cisco's internal security review, a software hardening release was issued that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked as CVE-2026-76285 relate to improper adherence to coding standards and are grouped under CWE-710.
- CVE-2026-76284Critical
As part of Cisco's internal security review, a software hardening release was issued that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked as CVE-2026-76284 relate to improper neutralization and are grouped under CWE-707.
- CVE-2026-76529Low risk· EPSS 6%
Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76529 relates to improper protection of alternate path (CWE-424).
- CVE-2026-76528Low risk· EPSS 3%
Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76528 relate to protection mechanism failure and are grouped under CWE-693.
- CVE-2026-76527Low risk· EPSS 3%
Cisco conducted a comprehensive internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76527 relate to improper check or handling of exceptional conditions and are grouped under CWE-703.
- CVE-2026-76526Low risk· EPSS 6%
Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76526 relates to improper neutralization (CWE-707).
- CVE-2026-76408Low risk· EPSS 6%
Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76408 relates to improper control of a resource through its lifetime (CWE-664).
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76530 are related to use of non-canonical URL paths for authorization decisions and are grouped under the Common Weakness Enumeration (CWE) CWE-647.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS