Cisco: critical RCE in Expressway, Unified CM and Snort 3 flaws
Cisco fixes 34 vulnerabilities: commands as root in Expressway (X15.5.20), three critical CVEs in Unified CM and UC products, 13 CVEs in Snort 3.
On 21 October 2026 Cisco published a new batch of security advisories, reported the same day by the Canadian Centre for Cyber Security (advisory AV26-1073) and on 22 October by INCIBE-CERT and SecurityWeek. According to SecurityWeek there are 34 fixes, covering Expressway Series, Unified Communications products, Snort 3, IOS XR and Secure Client. This is a different cycle from the one on 7 October, which focused on NX-OS and Nexus 3000 and 9000 switches: this time the priorities are collaboration (telephony and video conferencing) and the firewall inspection engine.
According to SecurityWeek, Cisco is not aware of any exploitation; INCIBE-CERT also marks the CVEs in the UC products as “not exploited”. None of the three sources gives CVSS scores, which you will find in Cisco’s advisories.
Expressway Series: commands as root
The most severe flaw described is CVE-2026-76466, rated critical, in Cisco Expressway Series. According to SecurityWeek, which quotes Cisco’s description, in certain configurations the use of persistent cookies and insufficient validation of client certificates allow an attacker to connect to the device’s database service and invoke specific RPC (remote procedure call) commands. If the attack succeeds, the attacker executes arbitrary commands as root on the underlying operating system. The sources do not say which configurations are affected or whether authentication is required: check the advisory.
The fix is in release X15.5.20, also cited by the Canadian Centre for Cyber Security (earlier releases are vulnerable). According to SecurityWeek, the same release resolves 10 vulnerabilities in total: besides CVE-2026-76466, eight CVEs that group several defects by CWE category and a medium-severity information disclosure flaw.
If the device is reachable from outside, exploitation maps to MITRE ATT&CK T1190 (Exploit Public-Facing Application). The sources report no indicators of compromise.
Unified CM and collaboration products: three critical CVEs
The second group covers Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (Unified CM), Unified CM IM & Presence Service, Unified CM Session Management Edition and Unity Connection, fixed with the October 2026 “Cisco Unified Communications Products Security Hardening Release”. The sources disagree on the count: SecurityWeek mentions nine CVEs, while INCIBE-CERT lists eight, three critical and five high-severity.
The three critical ones, cited by both, each group several defects of the same type:
- CVE-2026-76473: improper control of a resource through its lifetime, related to injection issues;
- CVE-2026-76474: improper authentication;
- CVE-2026-76475: improper neutralization of input during web page generation.
The high-severity CVEs listed by INCIBE-CERT are CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479 and CVE-2026-76481.
According to INCIBE-CERT, vulnerable versions are affected regardless of configuration and there are no workarounds. Release 15 must be updated to 15SU5 (also confirmed by the Canadian Centre for Cyber Security); release 14 must be migrated to a fixed release.
Snort 3 and the products that embed it: 13 CVEs
According to SecurityWeek, 13 CVEs affect Snort 3, the intrusion detection engine Cisco embeds in several products. The most severe, CVE-2026-20236 and CVE-2026-20043, group critical incorrect calculation and out-of-bounds write issues; the others include high-severity flaws (privilege management, resource consumption, arbitrary command execution) and medium-severity ones.
The fixes are in Snort 3 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD and UTD for IOS XE. The Canadian Centre for Cyber Security lists Cyber Vision before 5.6.0 and multiple versions of Secure FTD as vulnerable. The sources do not describe the attack vector.
IOS XR and Secure Client
- IOS XR: CVE-2026-76505, a high-severity denial of service; multiple versions affected, according to the Canadian Centre for Cyber Security.
- Secure Client: CVE-2026-76462, a high-severity privilege escalation in the Secure Firewall Posture module; releases before 5.1.20.333 are vulnerable. In ATT&CK it maps to T1068 (Exploitation for Privilege Escalation).
Impact for European and Italian companies
Expressway and Unified CM run the telephony and video conferencing of many companies and public bodies. Expressway is often used as a gateway to connect from outside the corporate network: if yours is reachable from the Internet, CVE-2026-76466 comes first. Emergency Responder handles the location of emergency calls: a real concern for hospitals and healthcare facilities, where internal telephony is part of clinical processes.
For NIS2 entities this falls under vulnerability management with documented priorities and timelines; a significant incident caused by exploitation must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). The Snort 3 flaws affect firewalls and devices that inspect traffic: updating them usually requires a maintenance window, which you should plan now.
What to do now
- Take inventory of Expressway, Unified CM and the other UC products, Secure FTD and ASA firewalls, Meraki MX, Cyber Vision, IOS XR routers and endpoints with Secure Client, with their installed releases.
- Update Expressway to X15.5.20, starting with systems reachable from the Internet.
- Move UC products on release 15 to 15SU5 and plan the migration of those on release 14: according to INCIBE-CERT there are no workarounds.
- Update Snort 3 to 3.12.4.0 and the products that embed it, checking the fixed releases with Cisco Software Checker.
- Update Secure Client to 5.1.20.333 where you use the Secure Firewall Posture module, and IOS XR to the release indicated by Cisco.
- Restrict access to the Expressway and Unified CM administration interfaces to a separate management network: good general practice, not a substitute for updating.
- Monitor anomalous connections to Expressway services, unexpected commands and router or firewall reboots, sending logs to an external system.
How ARXDOME helps
ARX Expose shows which services your company exposes on the Internet and which have known vulnerabilities: you can check whether an Expressway or a telephony management interface is reachable from outside. ARX Sentry collects logs from firewalls and network devices in a central collector, so reboots and anomalies stay recorded outside the affected devices.
Last updated:
