Cisco, Splunk and SonicWall October 2026 Fixes: Products, Branches and Dates

Direct answer

The reviewed Cisco Meraki, Splunk Enterprise and SonicWall SMA1000 advisories have different product scopes and original dates. They do not establish a new October 9 emergency release or a customer breach. Match the exact installed branch to its vendor table, and distinguish available updates from Cisco releases still planned for later October or November.

Original event dates and this article

Cisco Meraki first publication: October 7 16:00 GMT; last update: October 8 00:18 GMT, which is 05:48 IST and BEFORE the window starts at 10:50:15 IST. Splunk SVD-2026-1003 is dated October 7. SonicWall SNWLID-2026-0017 is dated October 6. Later coverage does not reset these original dates.

Cisco Meraki: affected products and branch-specific updates

Cisco’s October Meraki security hardening advisory covers Meraki Campus Gateways, MG Cellular Gateways, MR Wireless Access Points, MS Series Switches, MV Smart Cameras, and MX Security and SD-WAN Appliances. Cisco says the issues were found during internal testing and are not known to be actively exploited. It lists no workaround.

The affected and fixed versions depend on the product and release branch. Examples include MR 33.1.3, MS 18.1.9 (planned mid-October 2026) or IOS XE 17.18.4.1, and MX 26.1.7 or 26.2.3. Some branches have later planned fixes, including Campus Gateway 32.2.5 in late October and 33.1.4 in mid-November. Administrators should use Cisco’s advisory and software checker rather than assume that one version applies to every Meraki device.

To check safely, identify the exact Meraki product, software branch, and current version in the Dashboard. Compare that combination with Cisco’s fixed-release table. If the device is on an affected branch, schedule the upgrade according to the product’s maintenance requirements and confirm configuration and memory prerequisites first. Cisco says there is no workaround for the underlying issues, so disabling unrelated features is not a substitute for the listed update.

A separate Cisco advisory batch covered critical Nexus NX-OS flaws. Those issues affect particular Nexus 3000 and 9000 configurations when features such as NX-API, NGOAM, or MPLS OAM are enabled. They are not the same issue set as the Meraki hardening release. Keep the product names and CVE groups separate when checking exposure.

Splunk Enterprise: affected ranges and fixed versions

Splunk’s SVD-2026-1003 advisory covers third-party package updates in Splunk Enterprise. Splunk says the fixes are included in Enterprise 10.4.3, 10.2.7, 10.0.10, and 9.4.15 or later.

The affected ranges are Enterprise 10.4.0 through 10.4.2, 10.2.0 through 10.2.6, 10.0.0 through 10.0.9, and 9.4.0 through 9.4.14. The advisory lists 24 CVE identifiers and package-level remediation involving components such as Go crypto and net libraries, the Go compiler, libcurl, and OpenTelemetry. It does not claim that these vulnerabilities are being exploited, and it does not report a public proof of concept.

Administrators should first record the exact Enterprise version and branch. If it falls in one of the affected ranges, plan an upgrade to the corresponding fixed maintenance release or a later supported version. After the upgrade, verify the running version and confirm that the relevant service and bundled components were updated. Do not infer that every Splunk product is covered: the advisory is specifically about Splunk Enterprise, while separate October advisories cover products such as the MCP Server and the Splunk Add-on for Amazon Web Services.

SonicWall: serious, but do not reset the event date

SonicWall’s SMA1000 advisory SNWLID-2026-0017 was first published on October 6, not October 8 or October 9. It covers four vulnerabilities: a pre-authentication SSRF, post-authentication command injection, a Zip Slip issue, and stored XSS. The affected products are SMA1000 models 6210, 7210, and 8200v on the older listed platform-hotfix versions. SonicWall lists fixed hotfixes 12.4.3-03670 and 12.5.0-03082 or later.

SonicWall says it has no evidence that the vulnerabilities are being exploited in the wild. The advisory also says that SSL-VPN running on SonicWall firewalls and the SMA 100 Series are not affected. That makes this a patching item for the specific SMA1000 scope, but not a newly issued emergency patch within the current editorial window.

The October 6 SMA1000 advisory names CVE-2026-102255, CVE-2026-102256, CVE-2026-102257 and CVE-2026-102258. Its affected hotfixes are 12.4.3-03526 and older, or 12.5.0-02952 and older. The fixed hotfixes are 12.4.3-03670 and 12.5.0-03082 or higher. These details do not describe the separate SMA 100 series.

What defenders should do now

Start with asset inventory. Match each device or server to the exact vendor, product family, release branch, and installed version. Apply the vendor’s fixed release when the asset is in scope, after checking backup, change-control, and service-impact requirements. For internet-facing remote-access appliances, review authentication and management logs for unusual activity while preserving evidence. A vendor advisory’s statement about exploitation is not proof that a particular customer was compromised; investigate local telemetry before drawing that conclusion.

Are these confirmed breaches?

No. The Cisco Meraki advisory says the findings came from internal testing and are not known to be actively exploited. Splunk’s advisory describes package fixes but does not claim exploitation. SonicWall’s primary October 6 advisory says there is no evidence of in-the-wild exploitation. Those statements describe vendor knowledge, not the state of every customer environment.

Which update should I install?

There is no single update for all three vendors. Use Cisco’s product-specific Meraki fixed-release table, Splunk’s matching Enterprise maintenance branch, or SonicWall’s SMA1000 platform-hotfix table. Do not apply a CVE or version from a different product family because the vendor name matches.

Decision checklist

• Record each affected asset, product model, branch and running version.
• Match Cisco Meraki devices to their product-specific first fixed release.
• Treat releases marked mid-October, late October or November as planned, not already available.
• Match Splunk Enterprise 10.4, 10.2, 10.0 or 9.4 to its own fixed maintenance version.
• Confirm SMA1000 model and platform-hotfix; do not apply its advisory to SMA100 or firewall SSL VPN.
• Preserve backups and configurations before controlled updates, then verify running versions and service health.

Limitations

• Admins still have precise product/branch checks to perform, but the user headline emergency patches issued today overstates verified freshness and exploit status. Cisco says internally found/not known actively exploited; Splunk reports package remediation without an exploitation claim; SonicWall says no evidence of in-the-wild exploitation.
• Reviewed 9 October 2026; source-event dates differ from this article’s first publication.
• General defensive guidance is not a diagnosis or complete-cleanup guarantee.
• No verified query volume, Google Trends score, victim total or ranking guarantee is asserted.

Evidence sources

1. Cisco PSIRT — Cisco Meraki primary advisory — scope, dates and branch-specific fixes
2. Splunk Security — Splunk primary SVD-2026-1003 — affected/fixed Enterprise versions
3. SonicWall PSIRT — SonicWall primary advisory — older SMA1000 scope and hotfixes
4. BleepingComputer — BleepingComputer October 8 — independent Cisco batch context; separate Nexus issues