Cisco Patches 34 Flaws in Expressway, IOS XR and More
Cisco patched 34 vulnerabilities on Oct. 21, including a critical Expressway flaw that could let attackers run arbitrary commands as root on affected devices.
Cisco released patches Wednesday, Oct. 21, for 34 vulnerabilities affecting Expressway Series, IOS XR, Snort 3 and Unified Communications products. The flaws include critical, high- and medium-severity issues.
Expressway Series received fixes for 10 vulnerabilities, including the critical remote code execution flaw CVE-2026-76466. In certain configurations, persistent cookies and weak client certificate checks could let an attacker connect to the database service and issue specific remote procedure calls. A successful attack could enable arbitrary commands with root privileges on the underlying operating system.
Cisco fixed the Expressway flaw in version X15.5.20. The release addresses eight other CVEs classified under their respective Common Weakness Enumeration categories, along with a separate medium-severity information disclosure flaw.
The company patched nine vulnerabilities in its Unified Communications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, Unified Communications Manager IM & Presence Service, Unified Communications Manager Session Management Edition and Unity Connection. The most severe are CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475, which involve resource control, authentication and input handling.
Cisco addressed 13 Snort 3 vulnerabilities across several products. CVE-2026-20236 and CVE-2026-20043 cover critical issues involving incorrect calculations and out-of-bounds writes. Other fixes address privilege changes, excessive resource use, arbitrary command execution and information disclosure.
The Snort fixes are included in version 3.12.4.0 and security updates for Cyber Vision, CDFW, Meraki MX, Cisco Security Agent, Secure Firewall ASA, Secure Firewall Management Center, Secure Firewall Threat Defense and Unified Threat Defense for IOS XE.
Cisco patched the high-severity denial-of-service vulnerability CVE-2026-76505 in IOS XR and the high-severity privilege escalation flaw CVE-2026-76462 in the Secure Firewall Posture module of Cisco Secure Client. The company says it is not aware of exploitation of the vulnerabilities in the wild. Further details are available in Cisco’s security advisories and its Oct. 21 security notification.
Articles by this author
