Cisco Patches 25 Vulnerabilities Across Multiple Products, Including Critical Expressway Flaw
Cisco patched 25 vulnerabilities across Expressway, Unified Communications, IOS XR, and Snort 3, including critical flaws allowing root command execution.
Key findings
- Cisco disclosed 25 vulnerabilities across multiple products on October 21, 2026, with a critical RCE flaw in Expressway Series (CVE-2026-76466).
- Ten vulnerabilities were patched in Cisco Expressway Series, including CVE-2026-76466 (CVSSv3 9.8) affecting clustered deployments.
- Multiple Cisco Unified Communications products were affected by critical and high-severity flaws, patched in recent software releases.
- Snort 3 component vulnerabilities (CVE-2026-76524, CVE-2026-76489, CVE-2026-76445) could lead to command execution or service disruption.
- Cisco IOS XR Software and Cisco Secure Client also received patches for vulnerabilities disclosed in this batch.
On October 21, 2026, Cisco disclosed a significant batch of 25 vulnerabilities affecting a wide range of its products, including Cisco IOS XR Software, Expressway Series, Unified Communications Manager, and Snort 3. This coordinated disclosure event, spanning a mere six hours, highlights Cisco's proactive approach to identifying and rectifying security weaknesses through internal reviews. The vulnerabilities range in severity from Medium to Critical, with several carrying high CVSS scores, underscoring the potential impact on affected systems.
A notable cluster of vulnerabilities impacts the Cisco Expressway Series, with ten CVEs addressed in a single software hardening release. Among these, CVE-2026-76466 stands out as a critical vulnerability (CVSSv3 9.8) that could allow unauthenticated, remote attackers to execute arbitrary operating system commands as root. This flaw is attributed to the use of persistent cookies in the database service. Other Expressway vulnerabilities include CVE-2026-76490 (High, CVSSv3 8.6) and CVE-2026-76495 (High, CVSSv3 7.8), among others, all fixed in version X15.5.20. Cyber Security News, SecurityWeek
Cisco Unified Communications products are also affected by a series of high and critical severity vulnerabilities. CVE-2026-76474 and CVE-2026-76473, both rated Critical (CVSSv3 9.8), and CVE-2026-76475 (Critical, CVSSv3 9.3) are among the most severe. These flaws, along with others like CVE-2026-76478 and CVE-2026-76477 (both High, CVSSv3 8.8), were addressed in software hardening releases for products including Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, and Cisco Unified Communications Manager IM & Presence Service.
The Snort 3 component is implicated in several vulnerabilities, including CVE-2026-76524 (High, CVSSv3 7.8), which allows local attackers to execute arbitrary commands. Additionally, CVE-2026-76489 (Medium, CVSSv3 5.8) and CVE-2026-76445 (Medium, CVSSv3 5.3) relate to Snort 3's detection engine, potentially causing restarts or interruptions in packet inspection. Cisco IOS XR Software also sees a vulnerability, CVE-2026-76505 (High, CVSSv3 7.5), affecting its IPv4 packet processing.
The batch also includes several vulnerabilities discovered through Cisco's internal security reviews, such as CVE-2026-76530 and CVE-2026-76407, which were part of a broader set of disclosures by Cisco and related entities. While the provided information does not detail specific threat actors or widespread exploitation campaigns linked to this batch, the critical nature of some vulnerabilities, particularly CVE-2026-76466 on Expressway Series, warrants immediate attention.
Cisco has released patches and software updates for all affected products. Users are strongly advised to consult the individual Cisco security advisories for specific version information and remediation steps. For Expressway Series, version X15.5.20 is recommended. For Unified Communications products, specific versions vary by product line. The Snort 3 vulnerabilities are addressed in updated releases, and Cisco IOS XR Software also received necessary patches.
This extensive disclosure event underscores the importance of regular security reviews and timely patching for complex network infrastructure. Users of Cisco products should prioritize applying the available updates to mitigate the risks associated with these vulnerabilities, especially those impacting critical infrastructure like Expressway Series and Unified Communications. Staying informed about Cisco's security advisories is crucial for maintaining a robust security posture.