Cisco Patches 34 Vulnerabilities Across Multiple Products
Summary
Cisco patched 34 vulnerabilities across Expressway, IOS XR, Snort 3, Unified Communications and other products. The flaws include critical issues; Cisco says it is unaware of exploitation in the wild.
Key points
- Cisco announced fixes for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, Unified Communications products and other Cisco products.
- Expressway Series fixes include critical RCE CVE-2026-76466. Cisco says certain configurations could allow attackers to invoke RPC commands and execute arbitrary commands as root.
- CVE-2026-76466 is fixed in Expressway Series version X15.5.20.
- Unified Communications products received fixes for nine CVEs, including three critical issues: CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475.
- Snort 3-related fixes address 13 CVEs, including critical issues CVE-2026-20236 and CVE-2026-20043. Fixes are included in Snort 3 version 3.12.4.0 and security updates for additional Cisco products.
- Cisco also patched high-severity DoS vulnerability CVE-2026-76505 in IOS XR and privilege-escalation vulnerability CVE-2026-76462 in Secure Client’s Secure Firewall Posture module.
- Cisco says it is unaware of any of the vulnerabilities being exploited in the wild.
Article Details
- Vulnerability Types
- Remote code execution
- Information disclosure
- Improper resource control
- Improper authentication
- Improper input neutralization
- Incorrect calculation
- Out-of-bounds write
- Privilege management
- Resource consumption
- Denial of service
- Privilege escalation
- Severity
- Critical, high, and medium severity vulnerabilities are reported.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-20043Multiple Cisco products received patches for 13 CVEs affecting Snort 3, including CVE-2026-20236 and CVE-2026-20043, which group critical-severity incorrect calculation and out-of-bounds write issues.CVE-2026-20236Multiple Cisco products received patches for 13 CVEs affecting Snort 3, including CVE-2026-20236 and CVE-2026-20043, which group critical-severity incorrect calculation and out-of-bounds write issues.CVE-2026-76462and a high-severity privilege escalation bug in Secure Client’s Secure Firewall Posture module (CVE-2026-76462).CVE-2026-76466Expressway Series received fixes for 10 vulnerabilities, including a critical-severity remote code execution (RCE) bug tracked as CVE-2026-76466.CVE-2026-76473The most severe are CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475, three critical-severity issues that group multiple improper resource control, improper authentication, and improper input neutralization holes.CVE-2026-76474The most severe are CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475, three critical-severity issues that group multiple improper resource control, improper authentication, and improper input neutralization holes.CVE-2026-76475The most severe are CVE-2026-76473, CVE-2026-76474, and CVE-2026-76475, three critical-severity issues that group multiple improper resource control, improper authentication, and improper input neutralization holes.CVE-2026-76505Cisco patched a high-severity denial-of-service (DoS) vulnerability in IOS XR, tracked as CVE-2026-76505, and a high-severity privilege escalation bug in Secure Client’s Secure Firewall Posture module
Vendors
Products
CDFWissues, and were included in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Cisco FTDand in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Cisco IOS XR SoftwareCisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products.CSAand were included in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Cyber Visionas medium-severity issues, and were included in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Emergency ResponderCisco patched nine CVEs in Unified Communications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CMExpressway SeriesCisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products.Meraki MXissues, and were included in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Prime Collaboration DeploymentCisco patched nine CVEs in Unified Communications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CMSecure Clientvulnerability in IOS XR, tracked as CVE-2026-76505, and a high-severity privilege escalation bug in Secure Client’s Secure Firewall Posture module (CVE-2026-76462).Secure Firewall ASAin Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Secure FMC3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.Snort 3Cisco on Wednesday announced patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, and Unified Communications products.Unified CM Session Management EditionManager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME), and Unity Connection.Unified Communications ManagerCommunications products, including Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified CommunicationsUnified Communications Manager IM & Presence ServiceResponder, Prime Collaboration Deployment, Unified Communications Manager (CM), Unified Communications Manager IM & Presence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME), andUnity ConnectionPresence Service (CM IM&P), Unified Communications Manager Session Management Edition (CM SME), and Unity Connection.UTD for IOS XEupdates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE.