Cisco Patches 34 CVEs, Six Critical Across Products
Cisco released patches for 34 CVEs across Expressway, Unified Communications, and Snort 3. Six are critical-severity; no exploitation confirmed.
Morgan "airgap" ReyesCisco released patches Wednesday covering 34 CVEs across five product families. Six rate critical. No exploitation in the wild confirmed as of publication.
Expressway Series
CVE-2026-76466 (CVSS 9.8, critical): unauthenticated remote code execution as root via persistent cookie manipulation and insufficient certificate validation. Network-accessible; no credentials required. Nine additional medium-severity CVEs patched in the same bundle.
Unified Communications
Three critical authentication bypass flaws:
- CVE-2026-76473 (CVSS 9.8): authentication bypass
- CVE-2026-76474 (CVSS 9.8): authentication bypass via improper input handling
- CVE-2026-76475 (CVSS 9.3): authentication bypass
Six additional medium CVEs in this bundle.
Snort 3
CVE-2026-20043 (CVSS 9.0, critical): out-of-bounds write with privilege escalation potential. CVE-2026-20236 (CVSS 7.5, high): incorrect calculation. Eleven additional medium CVEs in this bundle.
IOS XR and Secure Client
CVE-2026-76505: denial-of-service in IOS XR, high severity. CVE-2026-76462: local privilege escalation in Secure Client, high severity.
Status
No exploitation confirmed as of publication. Confidence: high. All patches available now.
Source: SecurityWeek.
Previous Cisco coverage: Cisco Patches Exploited Email Gateway File Write Bug, Cisco Patches Five CVSS 9.8 Flaws in NX-OS, Cisco SD-WAN Manager Auth Bypass Exploited.
Found this useful? Share it.
