Cisco Patches 34 Vulnerabilities Across Multiple Products

Cisco patched 34 security vulnerabilities spanning Expressway Series, IOS XR, Snort 3, and Unified Communications products. The Expressway Series fixes include a critical remote code execution vulnerability (CVE-2026-76466) caused by persistent cookies and insufficient client certificate validation, allowing attackers to execute arbitrary commands as root. Unified Communications products received patches for multiple critical issues involving improper resource control, authentication, and input validation (CVE-2026-76473, CVE-2026-76474, CVE-2026-76475). Snort 3 patches address critical incorrect calculation and out-of-bounds write vulnerabilities (CVE-2026-20236, CVE-2026-20043) along with other high and medium severity bugs. Additional high-severity flaws include a denial-of-service vulnerability in IOS XR (CVE-2026-76505) and a privilege escalation bug in Secure Client’s Secure Firewall Posture module (CVE-2026-76462). Cisco has released official patches for all these issues and reports no known exploitation in the wild.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands with root privileges, bypass authentication mechanisms, perform cross-site scripting attacks, cause denial-of-service conditions, and escalate privileges on affected Cisco products. These impacts could compromise device integrity, confidentiality, and availability. However, Cisco currently reports no known active exploitation of these vulnerabilities in the wild.

Cisco has released official patches addressing all 34 vulnerabilities across the affected products. Users should apply the updates promptly to mitigate the risks. The Expressway Series vulnerability is fixed in version X15.5.20, Snort 3 in version 3.12.4.0, and other affected products have corresponding security updates as detailed in Cisco’s advisories. No additional mitigation steps are indicated beyond applying these patches.