Cisco published 14 security advisories covering 34 CVEs on October 21, 2026. The releases address vulnerabilities in Cisco Expressway Series, Snort 3, Unified Communications products, IOS XR on ASR 9000 routers, and the Secure Firewall Posture module in Cisco Secure Client.
The most serious issue is CVE-2026-76466, a Cisco Expressway Series vulnerability rated Critical with a CVSS base score of 9.8. Successful exploitation could give an attacker root-level command execution on an affected device.
Cisco’s PSIRT advance notice was first published on October 14, 2026 at 16:00 GMT and finalized as version 1.1 on October 21 at 16:09 GMT. Cisco strongly recommends installing the fixed software identified in each product advisory.
Expressway flaw can lead to root command execution
According to SecurityWeek’s reporting of Cisco’s findings, CVE-2026-76466 stems from persistent-cookie use combined with inadequate client-certificate validation in certain configurations.
An attacker could connect to the database service and invoke particular remote procedure call commands. A successful attack would allow arbitrary command execution as root on the device’s underlying operating system.
SecurityWeek reports that the correction is available in Expressway Series version X15.5.20. It also says that this release resolves the eight vulnerabilities from CVE-2026-76490 through CVE-2026-76497, although its account does not clearly separate the release coverage for the RCE from that of the grouped hardening issues.
Cisco assigned the eight-CVE Expressway hardening advisory a High rating and a CVSS base score of 8.6. A separate information-disclosure issue, CVE-2026-76435, is rated Medium at 5.3.
Snort 3 vulnerabilities include command execution and inspection outages
Thirteen CVEs affect Snort 3 or Cisco products incorporating its detection engine. Cisco rated the four-CVE Snort 3 hardening advisory Critical with a score of 9.0:
- CVE-2026-20043: out-of-bounds write, classified as CWE-787. Its NVD record has a CVSS 3.1 score of 9.0 and describes a network-accessible attack requiring high complexity, without privileges or user interaction.
- CVE-2026-20236: incorrect calculation, CWE-682. Its individual NVD score is 7.5.
- CVE-2026-20291: improper privilege management, CWE-269. Its individual NVD score is 7.8 and reflects a local attacker with low privileges.
- CVE-2026-20356: uncontrolled resource consumption, CWE-400. Its individual NVD score is 7.5.
These individual NVD scores should not be confused with Cisco’s 9.0 rating for the combined hardening advisory.
Another significant Snort issue, CVE-2026-76524, has a High rating and a 7.8 score. It affects the Snort 3 control-channel socket and requires an authenticated local attacker with low privileges. Because the socket does not authenticate a connecting local user, exploitation could permit commands to run as the Snort 3 process user and allow access to the process’s memory.
Several remotely reachable flaws can instead interrupt packet inspection by forcing the Snort 3 Detection Engine to restart:
- CVE-2026-76489 involves incomplete error handling and unreleased memory while files are processed. An unauthenticated remote attacker could trigger the condition by submitting a large volume of files.
- CVE-2026-20019 affects NetFlow parsing. A crafted UDP NetFlow packet sent through an established connection can produce a denial of service.
- CVE-2026-20179 concerns GRE packet parsing and can be triggered with a crafted GRE packet.
Each of those three vulnerabilities carries a CVSS score of 5.8. Cisco’s other Snort advisories cover CVE-2026-20197, CVE-2026-20221, CVE-2026-20011, CVE-2026-20218, and CVE-2026-76445.
SecurityWeek reports that the Snort 3 issues are fixed in version 3.12.4.0. It also identifies affected Cisco implementations including Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.
Unified Communications advisory carries a 9.8 score
Cisco rated its eight-CVE Unified Communications hardening advisory Critical with a CVSS base score of 9.8. It contains:
- CVE-2026-76473
- CVE-2026-76474
- CVE-2026-76475
- CVE-2026-76476
- CVE-2026-76477
- CVE-2026-76478
- CVE-2026-76479
- CVE-2026-76481
SecurityWeek describes the first three as involving improper resource control, improper authentication, and inadequate input neutralization. Cisco’s advisory-level Critical rating applies to the complete eight-CVE group rather than only those three entries.
The affected Unified Communications product list reported by SecurityWeek includes Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, Unified Communications Manager IM & Presence Service, Unified Communications Manager Session Management Edition, and Unity Connection.
Cisco also published a Medium-severity advisory for CVE-2026-76487, an improper access-control vulnerability in Unified Communications Manager with a score of 5.3.
IOS XR and Secure Client also receive fixes
The remaining two CVEs affect separate product areas:
| CVE | Product and impact | Cisco rating | CVSS |
|---|---|---|---|
| CVE-2026-76505 | IOS XR Software for ASR 9000 Series Routers; denial of service involving IPv4 unicast packets | High | 7.5 |
| CVE-2026-76462 | Cisco Secure Client Secure Firewall Posture module; privilege escalation | High | 5.5 |
Across the full release, the 34 CVEs break down into 13 for Snort 3, 10 for Expressway, nine for Unified Communications, and two covering IOS XR and Secure Client.
Upgrade guidance and exploitation status
Cisco’s advance notice says no workarounds are available at the notice level and directs customers to upgrade to the fixed software specified in each individual advisory. That statement does not establish whether every underlying advisory has the same workaround status.
SecurityWeek reports that Cisco was not aware of exploitation in the wild. The Critical and High CVSS ratings describe potential technical impact; they are not evidence that attackers are currently using the flaws.
Administrators should first identify exposed Expressway deployments and check whether the configuration conditions for CVE-2026-76466 apply. Snort operators should also prioritize the move to 3.12.4.0, particularly where an engine restart would suspend packet inspection. Other Cisco products should be matched against their respective advisories before installing the designated fixed release.
