Cisco patches 34 flaws, including critical root-level bug in Expressway

Cisco has released security updates for 34 vulnerabilities affecting its Expressway Series, Unified Communications products, the Snort 3 detection engine, IOS XR and Secure Client, according to SecurityWeek. Several of the flaws are rated critical, including an Expressway bug that could allow an attacker to execute arbitrary commands as root. Cisco announced the fixes in advisories published this week and said it is not aware of any of the vulnerabilities being exploited in the wild.

What happened

According to SecurityWeek, the largest share of fixes went to Snort 3, with 13 CVEs, followed by the Expressway Series with 10 and the Unified Communications portfolio with nine. The remaining issues affect IOS XR and the Secure Firewall Posture module of Cisco Secure Client. Because Snort 3 is embedded in many Cisco security products, the related updates also cover Cyber Vision, Secure Firewall ASA, Secure Firewall Management Center (FMC), Secure Firewall Threat Defense (FTD), Meraki MX and UTD for IOS XE, among others.

Technical details

The most serious Expressway issue, tracked as CVE-2026-76466, stems from persistent cookies and weak client certificate validation, SecurityWeek reported. An attacker could abuse these weaknesses to reach the device's database service and invoke RPC commands, which could ultimately lead to arbitrary command execution as root. The Expressway release also resolves eight CVEs that group multiple weaknesses under common CWE categories, along with a medium-severity information disclosure bug.

In the Unified Communications line, three critical CVEs, CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475, each bundle improper resource control, authentication or input neutralization issues. They affect Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, its IM & Presence and Session Management editions, and Unity Connection.

For Snort 3, the publication said the critical entries CVE-2026-20236 and CVE-2026-20043 group incorrect calculation and out-of-bounds write issues. The Snort release also fixes high-severity privilege management, resource consumption and command execution bugs. Separately, CVE-2026-76505 is a high-severity denial-of-service flaw in IOS XR, and CVE-2026-76462 is a high-severity privilege escalation bug in the Secure Firewall Posture module. SecurityWeek did not report CVSS scores for the individual flaws.

Who is affected

Organizations running Cisco Expressway for video and collaboration traffic, Unified Communications Manager and related voice platforms, and any Cisco firewall or security appliance that relies on Snort 3 are the main audience for these updates. Expressway systems are often exposed at the network edge to connect external users, which makes timely patching more important.

What to do

Administrators should upgrade Expressway to X15.5.20 and Snort 3 to 3.12.4.0, and apply the corresponding updates for ASA, FTD, FMC, Meraki MX and other products that embed Snort. Unified Communications, IOS XR and Secure Client users should review Cisco's individual advisories for fixed releases. Although no exploitation has been reported, Cisco edge devices are frequent targets, so internet-facing Expressway deployments should be prioritized.