Cisco patches 34 vulnerabilities including critical remote code execution flaws

Cisco issued an October 21, 2026 notification covering 34 patched vulnerabilities in Unified Communications, Expressway Series, Snort 3, and IOS XR product lines.

Cisco said it is unaware that any of these vulnerabilities have been exploited in the wild. The batch’s most urgent item is a critical-severity remote code execution flaw in Expressway Series tracked as CVE-2026-76466. The batch includes critical-severity remote code execution and authentication flaws across Cisco products.

Cisco said attackers could use persistent cookies and weak client certificate validation to connect to the database service and issue RPC commands to exploit the flaw. RPC, or Remote Procedure Call, lets programs request services from other systems. If exploited, the flaw could permit arbitrary commands to execute with root privileges on the affected device. Persistent cookies remain stored after a browsing session ends.

Client certificate validation confirms the identity of a connecting system. The database service allows stored data to be queried and managed. Expressway Series version X15.5.20 contains the fix and also resolves eight CVEs grouped by Common Weakness Enumeration category along with a medium-severity information disclosure bug. Common Weakness Enumeration is a classification system for software weaknesses.

Nine CVEs in Unified Communications products received patches from Cisco, covering Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Critical-severity CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475 represent the most severe Unified Communications issues. The groupings cover improper input neutralization, improper authentication, and improper resource control. Information disclosure exposes data that should remain hidden.

Improper resource control fails to limit system resources properly. Improper authentication fails to verify identity correctly. Improper input neutralization fails to clean data before processing.

Thirteen CVEs affecting Snort 3 make up the largest single product group in the patch batch. Snort 3 is an intrusion prevention system. The group involves critical-severity CVE-2026-20236 and CVE-2026-20043 tied to incorrect calculation and out-of-bounds write flaws.

Incorrect calculation produces wrong numeric results. Out-of-bounds write writes data outside allocated memory.

According to Cisco, the Snort 3 updates handle high-severity privilege management, resource consumption, and arbitrary command execution flaws, along with medium-severity issues in version 3.12.4.0. Privilege management failures let users exceed their access rights. Resource consumption can exhaust system capacity. Arbitrary command execution lets an attacker run chosen commands.

Cyber Vision, CDFW, and Meraki MX received security updates containing Snort 3 updates. CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE also received security updates containing Snort 3.

IOS XR received a patch for a high-severity denial-of-service vulnerability tracked as CVE-2026-76505. A denial-of-service flaw can disrupt availability by making a system unreachable. Denial-of-service attacks aim to make services unavailable.

The Secure Client Secure Firewall Posture module received a fix for a high-severity privilege escalation issue tracked as CVE-2026-76462. Privilege escalation lets an attacker gain higher access rights than intended. Privilege escalation attacks seek elevated system permissions.

On May 25, 2026, Cisco said it is shifting to risk-based vulnerability disclosure. The approach prioritizes issues under active exploitation. It also covers issues more likely to be used in attacks. Under this approach, some internally discovered issues may stop receiving standalone advisories.

They may receive higher-level information about patched software releases instead. Critical issues and actively exploited findings will continue to receive detailed disclosures. Vulnerabilities seen as more likely to be exploited will also receive detailed disclosures too.

On May 25, 2026, Russ Smoak, Cisco vice president of information security, said AI models accelerate finding and fixing vulnerabilities at a previously unattainable pace. “Cisco is actively leveraging advanced AI Models to accelerate finding vulnerabilities and driving remediation,” Smoak said. He also said adversaries will take advantage of evolving AI capabilities, increasing the urgency and complexity of cybersecurity defense.