> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Cisco patches critical RCE in Expressway Series and Unified Communications - URL: https://f4n6.co.uk/security-feed/cisco-patches-critical-rce-in-expressway-series-and-unified-communications/ - Published: 2026-10-22T13:47:28.000Z - Updated: 2026-10-22T13:47:28.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-20236 ## 1\. Executive summary Cisco has released fixes for 34 vulnerabilities across Expressway Series, Unified Communications, Snort 3, IOS XR and Secure Client, announced on 2026-10-21\. The most severe is CVE-2026-76466 in Expressway Series, CVSS 9.8 critical, a remote code execution flaw that lets an attacker run arbitrary commands as root on the underlying operating system. Three further criticals sit in Unified Communications (CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, all CVSS 9.8) and one in Snort 3 (CVE-2026-20043, CVSS 9.0). None of the eight CVEs in this advisory is listed in CISA KEV and Cisco states it is not aware of in-the-wild exploitation. For EMEA financial services the exposure is concentrated in perimeter collaboration infrastructure: Expressway and Unified Communications sit at the network edge handling SIP and remote-access sessions, so an unpatched, internet-facing deployment carries the full weight of a 9.8 root-level RCE. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | DORA Art. 17 | Expressway and Unified Communications are ICT systems whose compromise yields root-level command execution, so the incident management process must cover detection and response for these edge systems, not only core banking. | Confirm the incident management runbook covers Expressway/UC edge compromise and that root-level RCE on these systems is a defined escalation path. | | DORA Art. 28 | Expressway, Unified Communications and Snort 3 are third-party ICT components from Cisco, and remediation depends on the vendor's fixed versions (Expressway X15.5.20, Snort 3 3.12.4.0). | Verify the Cisco support and patch-entitlement position for each deployed version, and that the contract obliges timely security updates for these products. | | NIS2 Art. 21(2)(d) | The fixes depend on applying vendor-supplied versions across a supply chain of Cisco products, including components embedded in Secure Firewall, Meraki MX and Cyber Vision. | Confirm supply chain security measures include tracking and applying Cisco security advisories for embedded and edge components. | ## 3\. Technical analysis & attack chain This is a vendor patch cycle covering 34 CVEs. Eight carry verified severity data and are triaged below; the remainder are grouped CVEs the source describes only by category. Cisco states it is not aware of any of these being exploited in the wild, and none is in CISA KEV. Triage table, KEV entries first (none), then by CVSS: | CVE | Component | CVSS | KEV / EPSS | Why it matters | | -------------- | --------------------------------------------- | ------------ | ---------------- | ---------------------------------------------------------------------------------- | | CVE-2026-76466 | Expressway Series | 9.8 critical | Not in KEV / n/a | Root-level RCE reachable via the database service; CWE-798 hard-coded credentials. | | CVE-2026-76473 | Unified Communications | 9.8 critical | Not in KEV / n/a | Groups multiple improper resource control issues; CWE-74 injection class. | | CVE-2026-76474 | Unified Communications | 9.8 critical | Not in KEV / n/a | Improper authentication (CWE-287); authentication bypass class across UC products. | | CVE-2026-76475 | Unified Communications | 9.3 critical | Not in KEV / n/a | Cross-site scripting (CWE-79) in UC web interfaces. | | CVE-2026-20043 | Snort 3 | 9.0 critical | Not in KEV / n/a | Out-of-bounds write (CWE-787) in the detection engine itself. | | CVE-2026-20236 | Snort 3 | 7.5 high | Not in KEV / n/a | Incorrect calculation (CWE-682). | | CVE-2026-76505 | IOS XR | 7.5 high | Not in KEV / n/a | Improper input validation (CWE-20); source describes a denial-of-service. | | CVE-2026-76462 | Secure Client, Secure Firewall Posture module | 5.5 medium | Not in KEV / n/a | Improper input validation (CWE-20); source describes a privilege escalation. | Note a discrepancy on CVE-2026-76462: the source calls it high severity, while NVD records CVSS 5.5 medium. The verified score governs. The source also describes CVE-2026-76505 as high-severity DoS, consistent with the 7.5 high rating. The two entries warranting mechanism detail: CVE-2026-76466, Expressway Series. Cisco attributes the flaw to the use of persistent cookies and insufficient validation of client certificates in certain configurations. An attacker able to reach the database service can connect and invoke specific remote procedure call (RPC) commands. Successful exploitation executes arbitrary commands as root on the underlying operating system. The fixed release is Expressway Series X15.5.20, which also resolves eight grouped CVEs and a medium-severity information disclosure bug. The source does not name the exposed port or the exact configuration that enables the path, so defenders should treat any internet-facing Expressway with the database service reachable as exposed until the version is confirmed. CVE-2026-20043 and the Snort 3 cluster. Snort 3 received fixes for 13 CVEs, including CVE-2026-20236 and CVE-2026-20043, which group incorrect calculation and out-of-bounds write issues. The fixes ship in Snort 3 version 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE. A memory-safety flaw in the detection engine is significant because the engine processes untrusted traffic by design; the source gives no exploitation detail beyond the CWE classification. Unified Communications. Nine CVEs were patched across Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (CM), CM IM & Presence Service (CM IM&P), CM Session Management Edition (CM SME), and Unity Connection. The three criticals group improper resource control, improper authentication, and improper input neutralization holes. The source does not map each CVE to a specific product or give exploitation preconditions. IOS XR and Secure Client. CVE-2026-76505 is a high-severity DoS in IOS XR. CVE-2026-76462 is a privilege escalation in Secure Client's Secure Firewall Posture module. The source gives no further mechanism for either. Confidence caveat: all technical detail here rests on a single SecurityWeek report summarising Cisco's advisories. Cisco's own advisory text, affected-version matrices and any workarounds were not available in the source material. Verify against Cisco's security advisory page before relying on version boundaries. ## 4\. Mitigation & containment P1 within 24h - Inventory every Expressway Series deployment and confirm version. Upgrade any instance below X15.5.20 to X15.5.20\. Where upgrade cannot happen immediately, remove internet reachability to the Expressway database service and restrict it to trusted management hosts. - Inventory Unified Communications products (Emergency Responder, Prime Collaboration Deployment, CM, CM IM&P, CM SME, Unity Connection) and apply the Cisco security updates for the nine UC CVEs. Prioritise any UC node reachable from untrusted networks. - Confirm whether Snort 3 is in use and at what version; plan the move to 3.12.4.0. P2 within 72h - Apply the Snort 3 3.12.4.0 update and the corresponding security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD, and UTD for IOS XE. - Patch IOS XR for CVE-2026-76505 and Secure Client's Secure Firewall Posture module for CVE-2026-76462. - Review edge logs for anomalous connections to Expressway database services and for unexpected RPC invocation patterns. P3 within 7 days - Fold the Cisco October 21 notification into the standing patch cycle and record which of the 34 CVEs apply to the estate, since the source does not enumerate all of them. - Re-verify that no Expressway or UC instance remains on a pre-fix version after the change window. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes vulnerability mechanisms but gives no hashes, network indicators, file paths or command strings. ## 6\. Detection Insufficient indicators to author detection rules. The source provides CWE classifications and affected product names but no artefact of the threat itself (no strings, filenames, registry keys, command lines or traffic patterns) on which to build a matching rule. ## CVE assessment 8 referenced CVEs — 5 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-76466](https://nvd.nist.gov/vuln/detail/CVE-2026-76466?ref=f4n6.co.uk) | 9.8 Critical | — | — | A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with… | | [CVE-2026-76473](https://nvd.nist.gov/vuln/detail/CVE-2026-76473?ref=f4n6.co.uk) | 9.8 Critical | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responde… | | [CVE-2026-76474](https://nvd.nist.gov/vuln/detail/CVE-2026-76474?ref=f4n6.co.uk) | 9.8 Critical | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responde… | | [CVE-2026-76475](https://nvd.nist.gov/vuln/detail/CVE-2026-76475?ref=f4n6.co.uk) | 9.3 Critical | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responde… | | [CVE-2026-20043](https://nvd.nist.gov/vuln/detail/CVE-2026-20043?ref=f4n6.co.uk) | 9.0 Critical | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software e… | | [CVE-2026-20236](https://nvd.nist.gov/vuln/detail/CVE-2026-20236?ref=f4n6.co.uk) | 7.5 High | — | — | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software e… | | [CVE-2026-76505](https://nvd.nist.gov/vuln/detail/CVE-2026-76505?ref=f4n6.co.uk) | 7.5 High | — | — | A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Serie… | | [CVE-2026-76462](https://nvd.nist.gov/vuln/detail/CVE-2026-76462?ref=f4n6.co.uk) | 5.5 Medium | — | — | A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client co… | ## 7\. Sources - SecurityWeek, Cisco Patches 34 Vulnerabilities Across Multiple Products, https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/, 2026-10-22. ## 8\. Adverse Trace position Adverse Trace assesses this as a high-priority patch cycle rather than an active incident: the top CVEs are 9.8 critical with root-level RCE potential, but none is in CISA KEV and Cisco reports no known exploitation, so the risk is exposure-driven and depends on how much Expressway and UC infrastructure a client runs at the edge. The technical detail is single-sourced from SecurityWeek's summary of Cisco's advisories; we have not seen Cisco's affected-version matrices or workarounds, so version boundaries should be confirmed against Cisco directly before change windows are scoped. We will obtain the Cisco October 21 advisory set to map each CVE to affected versions and any workarounds, and re-issue this note if Cisco revises the exploitation status or publishes indicators. Clients running internet-facing Expressway below X15.5.20 should treat the upgrade as the first action this week. --- [Read the original source →](https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*