Threat reportVulnerabilityTL-2026-4220

Cisco patches 34 vulnerabilities across Expressway (CVE-2026-76466 RCE), Unified Communications, Snort 3, IOS XR and Secure Client

criticalPATCHED

Cisco patches 34 vulnerabilities across Expressway (TL-2026-4220) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-23. It has no confirmed attribution, affects Cisco Expressway Series (Expressway-C and Expressway-E, clustered), references 10 CVEs (CVE-2026-76466, CVE-2026-76473, CVE-2026-76474), maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 9 indicators of compromise.

CVSS
9.8/10Critical
CVEs
10Referenced vulnerabilities
Techniques
4MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
9Indicators of compromise

Key facts for TL-2026-4220

Threat ID
TL-2026-4220
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
telecoms, government administration, finance, enterprise, critical infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
9

How Cisco patches 34 vulnerabilities across Expressway works

On 2026-10-21 Cisco released fixes for 34 vulnerabilities, including a CVSS 9.8 unauthenticated root RCE in clustered Expressway (CVE-2026-76466), three Critical flaws across Unified Communications products, and Critical Snort 3 flaws (CVE-2026-20043, CVE-2026-20236). Cisco reports no known exploitation or public exploit code.

Cisco's October 2026 disclosure bundle covers Expressway Series (10 flaws), Unified Communications (9), Snort 3 and dependent products (13), IOS XR (1) and Secure Client (1).

Expressway: CVE-2026-76466 (CVSS 9.8, CWE-798) affects Expressway-C and Expressway-E only when configured in a cluster. Persistent cookies combined with insufficient TLS client-certificate validation during clustering let an unauthenticated remote attacker who possesses the cookies connect to the database service and invoke RPC commands, executing arbitrary commands as root. Affected: X14 and earlier, and X15.5.3 and earlier; fixed in X15.5.20 (X14 and earlier must migrate to a fixed release). No workarounds. Discovered by Stefan Aleksic of Jane Street. The remaining Expressway flaws are grouped by CWE class plus one medium-severity information disclosure bug.

Unified Communications: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection are affected by internally discovered flaws grouped by CWE (advisory cisco-sa-voice-hardening-twgbH9e3). Three are Critical: CVE-2026-76473 (CWE-74, CVSS 9.8, AV:N/AC:L/PR:N/UI:N), CVE-2026-76474 (CWE-287 improper authentication, CVSS 9.8, unauthenticated network) and CVE-2026-76475 (CWE-79 cross-site scripting, CVSS 9.3, user interaction required, scope changed). Versions 14 through 15SU4 (Unified CM through 15SU4a) are listed as affected for Emergency Responder, Unified CM, IM&P and Unity Connection.

Snort 3: Advisory cisco-sa-hardening-snort3-ybgmhTQe, found in Cisco internal testing, covers CVE-2026-20043 (CWE-787 out-of-bounds write, CVSS 9.0, AV:N/AC:H/S:C/C:H/I:H/A:H), CVE-2026-20236 (CWE-682 incorrect calculation, CVSS 9.0 per the advisory), CVE-2026-20291 (improper privilege management, 7.8) and CVE-2026-20356 (uncontrolled resource consumption, 7.5). Open Source Snort 3 is fixed in 3.12.4.0; Snort 2 is not affected. Cloud-delivered Firewall and Secure Access were updated automatically on 2026-10-21 and Meraki MX via Dashboard; Secure Firewall Threat Defense and UTD on IOS XE require manual upgrades. Other affected products include Cyber Vision, and Secure Firewall ASA/FMC per SecurityWeek. Note: NVD lists CVE-2026-20236 as 7.5 (availability-only) while the Cisco advisory and SecurityWeek rate it Critical; defenders should follow Cisco's rating for prioritization.

IOS XR: CVE-2026-76505 (High, CVSS 7.5, CWE-20) lets an unauthenticated remote attacker send crafted for-us IPv4 packets to ASR 9000/9900/9902/9903 line cards, causing network processor errors, line card resets and traffic loss; transit IPv4 and IPv6 traffic do not trigger it.

Secure Client: CVE-2026-76462 (Secure Firewall Posture module) is a local privilege escalation through insufficient validation of messages sent to a local IPC socket, allowing limited file writes as SYSTEM/root on Windows, macOS and Linux. SecurityWeek rates it High while NVD lists CVSS 5.5 (Medium).

Cisco states it is not aware of exploitation in the wild for these vulnerabilities and no public PoC is documented. Because cve_list contains only CVEs named in the sources, the remaining CVEs in the 34-flaw bundle are not individually enumerated here.

MITRE ATT&CK techniques used in TL-2026-4220

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Application or System Exploitation

Affected products and versions in Cisco patches 34 vulnerabilities across Expressway

  • Cisco — Expressway Series (Expressway-C and Expressway-E, clustered)
    Vulnerable versions: X14 and earlier; X15.5.3 and earlier
    Fixed in: X15.5.20
  • Cisco — Unified Communications Manager, IM&P, Emergency Responder, Unity Connection
    Vulnerable versions: 14 through 15SU4 (Unified CM through 15SU4a)
    Fixed in: See cisco-sa-voice-hardening-twgbH9e3
  • Cisco — Open Source Snort 3 / Secure Firewall Threat Defense / Cyber Vision / UTD Snort IPS Engine
    Vulnerable versions: Snort 3 3.1.2.0-3.11.1.0; Cyber Vision 3.0.0-5.8.1; FTD 7.0.0-10.0.0
    Fixed in: Snort 3 3.12.4.0; Cisco fixed releases per advisory
  • Cisco — IOS XR on ASR 9000/9900/9902/9903
    Vulnerable versions: 6.7.1 through 24.4.1 (50+ releases)
    Fixed in: See cisco-sa-asr9k-tUyxcyXN
  • Cisco — Secure Client (Secure Firewall Posture module)
    Vulnerable versions: 4.9.x through 5.1.19.1862
    Fixed in: See cisco-sa-sec-client-priv-esc-muF8eZdm

Remediation for Cisco patches 34 vulnerabilities across Expressway

Patches

  • Expressway X15.5.20 (cisco-sa-vcs-static-cred-hr7EWZ8t)
  • Snort 3 3.12.4.0 and Cisco fixed releases (cisco-sa-hardening-snort3-ybgmhTQe)
  • Unified Communications fixes (cisco-sa-voice-hardening-twgbH9e3)
  • IOS XR fix (cisco-sa-asr9k-tUyxcyXN)
  • Secure Client fix (cisco-sa-sec-client-priv-esc-muF8eZdm)

Immediate actions

  • Upgrade clustered Cisco Expressway-C/E to X15.5.20 (CVE-2026-76466); X14 and earlier must migrate to a fixed release
  • Restrict network access to Expressway cluster/database service ports to cluster peers only
  • Inventory Unified CM, IM&P, Emergency Responder, Unity Connection, PCD and SME and apply the cisco-sa-voice-hardening-twgbH9e3 fixes
  • Upgrade Open Source Snort 3 to 3.12.4.0 or later; manually upgrade Secure Firewall Threat Defense and UTD on IOS XE to Cisco fixed releases

Workarounds

  • None available for CVE-2026-76466 or the Snort 3 advisory per Cisco

Longer-term hardening

  • Subscribe to Cisco PSIRT advisories and track CISA KEV for later exploitation of these CVEs
  • Keep management and collaboration interfaces off the public internet
  • Monitor Expressway, UC and Snort logs for anomalous RPC, authentication and process-restart events

CVEs associated with Cisco patches 34 vulnerabilities across Expressway

CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-20236, CVE-2026-20043, CVE-2026-20291, CVE-2026-20356, CVE-2026-76505, CVE-2026-76462

Weaknesses (CWE) in Cisco patches 34 vulnerabilities across Expressway

CWE-798, CWE-74, CWE-287, CWE-79, CWE-787, CWE-682, CWE-20

Timeline of Cisco patches 34 vulnerabilities across Expressway

  • Expressway X15.5.20 released to fix CVE-2026-76466; no workarounds, discovered by Stefan Aleksic of Jane Street
  • Open Source Snort 3 version 3.12.4.0 released with fixes for the Snort 3 flaws found in Cisco internal testing
  • Cisco Cloud-delivered Firewall and Secure Access auto-updated; Meraki MX updated via Dashboard
  • CVE-2026-76466, CVE-2026-20043, CVE-2026-76473/74/75, CVE-2026-76505 and CVE-2026-76462 published to NVD
  • Cisco publishes advisories for Expressway, Unified Communications, Snort 3, IOS XR and Secure Client vulnerabilities
  • SecurityWeek reports 34 patched vulnerabilities; Cisco not aware of exploitation in the wild

Sources cited for Cisco patches 34 vulnerabilities across Expressway

Detection coverage for TL-2026-4220

As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4220 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
9 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats