Cisco patches 34 flaws, including critical Expressway RCE CVE-2026-76466
Original title: Cisco Patches 34 Vulnerabilities Across Multiple Products
Fixes include Expressway X15.5.20 and Snort 3.12.4.0; Cisco says none are known to be exploited.
Cisco released patches for 34 vulnerabilities in Expressway Series, IOS XR, Snort 3, and Unified Communications products. The most severe Expressway issue, CVE-2026-76466, can yield root command execution through persistent cookies and weak client-certificate checks in some configurations. Critical flaws were also fixed in Unified Communications and Snort 3. Cisco says it is not aware of exploitation.
Unconfirmed: Cisco says it is not aware of exploitation; no independent confirmation is given.
- CVE-2026-76466 allows arbitrary commands as root on affected Expressway devices.
- Expressway fixes shipped in X15.5.20, which also covers eight grouped CVEs.
- Snort 3 fixes, including two critical issues, are in version 3.12.4.0.
- IOS XR DoS is CVE-2026-76505; Secure Client escalation is CVE-2026-76462.
- Three critical Unified Communications CVEs group authentication and input flaws.
Impact: Root command execution on Expressway; critical flaws in UC and Snort
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Expressway Series | — | X15.5.20 |
| Cisco Snort 3 | — | 3.12.4.0 |
| Cisco IOS XR | — | — |
| Cisco Secure Client Secure Firewall Posture | — | — |
| Cisco Unified Communications products | — | — |
- 1.Update Expressway Series to X15.5.20.
- 2.Update Snort 3 to 3.12.4.0 and related Cisco security updates.
- 3.Review Cisco's October 21 advisories for Unified Communications, IOS XR, and Secure Client.
- CVEs
- CVE-2026-76466CVE-2026-76473CVE-2026-76474CVE-2026-76475CVE-2026-20236CVE-2026-20043CVE-2026-76505CVE-2026-76462
- Vendors
- Cisco
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-20043+1 related CVE | Out-of-bounds write in Cisco open-source Snort 3 | 9.0 group max | — | ||
| CVE-2026-76462 | A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated… | 5.5 | — | ||
| CVE-2026-76466 | Unauthenticated root RCE in Cisco Expressway database service | 9.8 | — | ||
CVE-2026-76473+2 related CVEs | Resource lifetime issues in Cisco UC products (CWE-74) | 9.8 group max | — | ||
| CVE-2026-76505 | Unauthenticated DoS in Cisco IOS XR IPv4 for-us handling | 7.5 | — |
From the original article
2 min read at securityweek.comCritical-severity security defects could lead to command execution, authentication bypass, and XSS attacks. The post Cisco Patches 34 Vulnerabilities Across Multiple Products appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.