Cisco Patches 34 Vulnerabilities, Including Critical RCE in Expressway Series
Cisco has released security updates addressing 34 vulnerabilities across its Expressway Series, IOS XR, Snort 3, and Unified Communications products, with several critical flaws posing significant risks.
Cisco has announced the release of patches for a substantial number of vulnerabilities, totaling 34 across several of its product lines. The disclosed flaws carry critical severity ratings and could allow attackers to gain unauthorized command execution, bypass authentication mechanisms, or perform cross-site scripting (XSS) attacks. Organizations utilizing affected Cisco products are strongly advised to prioritize the application of these updates to mitigate potential security risks.
The Cisco Expressway Series is particularly affected, with ten vulnerabilities patched, including a critical remote code execution (RCE) bug identified as CVE-2026-76466. According to Cisco's advisory, the exploitation of this flaw is possible through the use of persistent cookies and insufficient validation of client certificates in specific configurations. Successful exploitation could grant an attacker arbitrary command execution with root privileges on the underlying operating system of an affected device.
The critical CVE-2026-76466 vulnerability has been resolved in Expressway Series version X15.5.20. This update also addresses eight other CVEs that collectively represent multiple vulnerabilities categorized under specific CWEs. Additionally, a medium-severity information disclosure bug affecting the Expressway Series has been fixed in the same release.
Cisco's Unified Communications products have also received attention, with nine CVEs patched across various components. These include Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME), and Unity Connection. The most severe among these are CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475, which are critical-severity flaws encompassing issues related to improper resource control, authentication, and input neutralization.
Furthermore, Cisco has addressed 13 CVEs impacting its Snort 3 platform. Notable among these are CVE-2026-20236 and CVE-2026-20043, which detail critical-severity incorrect calculation and out-of-bounds write vulnerabilities. The patches for Snort 3, released in version 3.12.4.0, also cover high-severity bugs related to privilege management, resource consumption, and arbitrary command execution, as well as medium-severity issues. These fixes extend to security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.
Beyond these areas, a high-severity denial-of-service (DoS) vulnerability in IOS XR, tracked as CVE-2026-76505, has been patched. Additionally, a high-severity privilege escalation bug within Secure Client’s Secure Firewall Posture module, identified as CVE-2026-76462, has also been resolved.
Cisco has stated that it is not aware of any of these vulnerabilities being actively exploited in the wild. Further details and comprehensive information can be accessed through Cisco's dedicated security advisories page and its October 21 notification.