Cisco fixes five critical vulnerabilities in Expressway, Unified Communications Manager and Snort 3
Cisco has released fixes for eight vulnerabilities, five of them rated critical. The most serious lets an unauthenticated remote attacker run commands as root on clustered Cisco Expressway devices; the rest affect its unified communications products and the Snort 3 engine.
What happened
On 21 October 2026 Cisco published a batch of security advisories fixing eight vulnerabilities, five of them rated critical. The details come from the vendor's advisories; NVD has not yet published these CVEs.
The most significant is CVE-2026-76466 (CVSS 9.8) in Cisco Expressway Series. According to Cisco's advisory, an unauthenticated remote attacker with network access to the device could execute arbitrary operating system commands as root. The flaw lies in the database service, which uses persistent cookies and, when TLS Verify Mode is enabled for clustering, does not validate client certificates: anyone holding those cookies can connect to the service and invoke specific RPC commands. It was reported by a researcher at the firm Jane Street.
Separately, an internal Cisco security review has produced hardening releases for its unified communications products and for Snort 3. Each of these CVEs groups several internally discovered flaws:
- CVE-2026-76473 (CVSS 9.8): flaws grouped under CWE-74, exploitable remotely without authentication.
- CVE-2026-76474 (CVSS 9.8): improper authentication (CWE-287), exploitable remotely without authentication.
- CVE-2026-76475 (CVSS 9.3): cross-site scripting (XSS); requires user interaction.
- CVE-2026-76476 (CVSS 8.8): improper input validation; requires an authenticated user.
- CVE-2026-76477 (CVSS 8.8): SQL injection; requires an authenticated user.
- CVE-2026-76478 (CVSS 8.8): improper access control; requires local access with credentials.
- CVE-2026-20043 (CVSS 9.0): out-of-bounds memory writes in Snort 3.
Who is affected
CVE-2026-76466 affects Cisco Expressway-C and Expressway-E, both virtual and appliance, when running a vulnerable release and configured in a cluster. Releases X14 and earlier and X15.5.3 and earlier are vulnerable.
According to Cisco, the six CVEs in the communications advisory (CVE-2026-76473 to CVE-2026-76478) affect Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (Unified CM), Unified CM IM & Presence Service, Unified CM Session Management Edition and Unity Connection.
CVE-2026-20043 affects Snort 3, Cisco's open-source intrusion detection engine used in several of its products. The available information does not specify which products are affected.
Exploitation status
None of the eight vulnerabilities is listed in CISA's KEV catalogue. For Expressway, Cisco says it is not aware of any public announcements or malicious use. Even so, three flaws score CVSS 9.8 and can be exploited remotely without credentials, so updates should not be delayed.
What to do
Cisco states there are no workarounds for CVE-2026-76466: upgrading is the only fix. For the remaining flaws the vendor has released hardening updates, but the available data does not list the specific versions.
- Inventory your Expressway-C and Expressway-E devices and check whether they run in a cluster.
- Upgrade Expressway to X15.5.20; if on X14 or earlier, migrate to a fixed release.
- As a general precaution, not a substitute for patching, review which systems have network access to your Expressway devices.
- Check Cisco's hardening advisory for Unified CM, Unity Connection and the other communications products, and apply the releases it lists.
- Identify the Cisco products that embed Snort 3 and review the relevant advisory.
Sources
Affected technologies
Vulnerabilities (8)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-20043 | Critical (9) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76466 | Critical (9.8) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76473 | Critical (9.8) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76474 | Critical (9.8) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76475 | Critical (9.3) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76476 | High (8.8) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76477 | High (8.8) | — | 10/21/2026 | Awaiting Analysis |
| CVE-2026-76478 | High (8.8) | — | 10/21/2026 | Awaiting Analysis |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.