# Cisco patches 34 vulnerabilities across Expressway (CVE-2026-76466 RCE), Unified Communications, Snort 3, IOS XR and Secure Client

> On 2026-10-21 Cisco released fixes for 34 vulnerabilities, including a CVSS 9.8 unauthenticated root RCE in clustered Expressway (CVE-2026-76466), three Critical flaws across Unified Communications products, and Critical Snort 3 flaws (CVE-2026-20043, CVE-2026-20236). Cisco reports no known exploitation or public exploit code.

- **Published:** 2026-10-23T04:46:56Z
- **Last reviewed:** 2026-10-23T04:46:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4220
- **ID:** TL-2026-4220
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-20236, CVE-2026-20043, CVE-2026-20291, CVE-2026-20356, CVE-2026-76505, CVE-2026-76462

## Description

Cisco's October 2026 disclosure bundle covers Expressway Series (10 flaws), Unified Communications (9), Snort 3 and dependent products (13), IOS XR (1) and Secure Client (1).

Expressway: CVE-2026-76466 (CVSS 9.8, CWE-798) affects Expressway-C and Expressway-E only when configured in a cluster. Persistent cookies combined with insufficient TLS client-certificate validation during clustering let an unauthenticated remote attacker who possesses the cookies connect to the database service and invoke RPC commands, executing arbitrary commands as root. Affected: X14 and earlier, and X15.5.3 and earlier; fixed in X15.5.20 (X14 and earlier must migrate to a fixed release). No workarounds. Discovered by Stefan Aleksic of Jane Street. The remaining Expressway flaws are grouped by CWE class plus one medium-severity information disclosure bug.

Unified Communications: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection are affected by internally discovered flaws grouped by CWE (advisory cisco-sa-voice-hardening-twgbH9e3). Three are Critical: CVE-2026-76473 (CWE-74, CVSS 9.8, AV:N/AC:L/PR:N/UI:N), CVE-2026-76474 (CWE-287 improper authentication, CVSS 9.8, unauthenticated network) and CVE-2026-76475 (CWE-79 cross-site scripting, CVSS 9.3, user interaction required, scope changed). Versions 14 through 15SU4 (Unified CM through 15SU4a) are listed as affected for Emergency Responder, Unified CM, IM&P and Unity Connection.

Snort 3: Advisory cisco-sa-hardening-snort3-ybgmhTQe, found in Cisco internal testing, covers CVE-2026-20043 (CWE-787 out-of-bounds write, CVSS 9.0, AV:N/AC:H/S:C/C:H/I:H/A:H), CVE-2026-20236 (CWE-682 incorrect calculation, CVSS 9.0 per the advisory), CVE-2026-20291 (improper privilege management, 7.8) and CVE-2026-20356 (uncontrolled resource consumption, 7.5). Open Source Snort 3 is fixed in 3.12.4.0; Snort 2 is not affected. Cloud-delivered Firewall and Secure Access were updated automatically on 2026-10-21 and Meraki MX via Dashboard; Secure Firewall Threat Defense and UTD on IOS XE require manual upgrades. Other affected products include Cyber Vision, and Secure Firewall ASA/FMC per SecurityWeek. Note: NVD lists CVE-2026-20236 as 7.5 (availability-only) while the Cisco advisory and SecurityWeek rate it Critical; defenders should follow Cisco's rating for prioritization.

IOS XR: CVE-2026-76505 (High, CVSS 7.5, CWE-20) lets an unauthenticated remote attacker send crafted for-us IPv4 packets to ASR 9000/9900/9902/9903 line cards, causing network processor errors, line card resets and traffic loss; transit IPv4 and IPv6 traffic do not trigger it.

Secure Client: CVE-2026-76462 (Secure Firewall Posture module) is a local privilege escalation through insufficient validation of messages sent to a local IPC socket, allowing limited file writes as SYSTEM/root on Windows, macOS and Linux. SecurityWeek rates it High while NVD lists CVSS 5.5 (Medium).

Cisco states it is not aware of exploitation in the wild for these vulnerabilities and no public PoC is documented. Because cve_list contains only CVEs named in the sources, the remaining CVEs in the 34-flaw bundle are not individually enumerated here.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1499.004 Application or System Exploitation

## Sources

- [Cisco Patches 34 Vulnerabilities Across Multiple Products (SecurityWeek)](https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/)
- [Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)
- [Cisco Snort 3 Security Hardening Advisory (cisco-sa-hardening-snort3-ybgmhTQe)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe)
- [Cisco Unified Communications Products Hardening Advisory (cisco-sa-voice-hardening-twgbH9e3)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3)
- [Cisco IOS XR ASR 9000 IPv4 DoS Advisory (cisco-sa-asr9k-tUyxcyXN)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr9k-tUyxcyXN)
- [Cisco Secure Client Privilege Escalation Advisory (cisco-sa-sec-client-priv-esc-muF8eZdm)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sec-client-priv-esc-muF8eZdm)
- [NVD CVE-2026-76466](https://nvd.nist.gov/vuln/detail/CVE-2026-76466)
- [NVD CVE-2026-20043](https://nvd.nist.gov/vuln/detail/CVE-2026-20043)
- [NVD CVE-2026-76473](https://nvd.nist.gov/vuln/detail/CVE-2026-76473)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4220