Cisco said its security response team published a batch of advisories on October 21, 2026. SecurityWeek reported that the fixes cover 34 vulnerabilities. Expressway Series got 10, Snort 3 got 13, and Unified Communications products got nine. IOS XR and Secure Client got one each. Cisco's table rates critical fixes in three areas: the Expressway remote code execution bug CVE-2026-76466 (score 9.8), the Unified Communications hardening release (9.8), and the Snort 3 hardening release (9.0).
SecurityWeek said Cisco ties the Expressway bug to persistent cookies and weak checks of client certificates in certain setups. An attacker could reach the database service and send remote procedure commands, which ask the system to run functions. That could end in commands run as root, the device's top-level account. The fix is in Expressway X15.5.20. Snort 3 fixes are in version 3.12.4.0. SecurityWeek said Cisco is not aware of any attacks. The sources here do not say who found the flaws or how many customers are exposed.
Cisco says it publishes fixes on the first and third Wednesday of each month, so teams can plan a regular patch window. Three questions follow. Which Expressway configurations are exposed? Who owns the Unified Communications patch window? Where do the advisories list affected versions?