Cisco Patches 34 Vulnerabilities Across Multiple Products

What it is

Cisco's 21 October 2026 advisory batch fixes 34 vulnerabilities in Expressway Series, Unified Communications products, Snort 3 and its downstream products, IOS XR and Secure Client. Cisco says it knows of no exploitation in the wild.

How it works

The critical Expressway bug, CVE-2026-76466, is a remote code execution flaw. Cisco attributes it to persistent cookies and insufficient validation of client certificates in certain configurations. An attacker can use this to connect to the database service and invoke specific RPC commands, which run arbitrary commands as root on the underlying operating system. The page does not say which configurations are affected.

Preconditions / Affected

• Expressway Series: 10 vulnerabilities. Besides CVE-2026-76466, X15.5.20 resolves eight CVEs that each group several flaws under one CWE category, plus a medium-severity information disclosure bug.
• Unified Communications: nine CVEs across Emergency Responder, Prime Collaboration Deployment, Unified CM, CM IM&P, CM SME and Unity Connection. The most severe are three critical CVEs that group improper resource control, improper authentication and improper input neutralization flaws: CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475.
• Snort 3: 13 CVEs. They include critical CVE-2026-20236 (incorrect calculation) and CVE-2026-20043 (out-of-bounds write), along with high-severity privilege management, resource consumption and arbitrary command execution bugs.
• Snort 3 downstream products: Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD and UTD for IOS XE.
• Other fixes: a high-severity IOS XR denial of service (CVE-2026-76505) and a high-severity privilege escalation in the Secure Firewall Posture module of Secure Client (CVE-2026-76462).

What to do

• Upgrade Expressway to X15.5.20 first, since it carries the only single critical RCE with a named mechanism.
• Upgrade Snort 3 to 3.12.4.0, and apply the security updates for each Cisco product that embeds it.
• Check the Cisco advisories for fixed releases for the Unified Communications products, IOS XR and Secure Client. The page gives no version numbers for them.

Caveats

The page does not give CVSS scores, fixed versions for the Unified Communications products, or workarounds. Several entries are grouped CVEs, so one identifier covers multiple underlying flaws. Cisco's advisory page and its 21 October notification hold the full detail.