Cisco advisories published October 21, 2026; coverage October 21 to 22, 2026
Cisco Patches 34 Flaws Across Voice, Expressway and Snort 3, With Two Voice Bugs at 9.8
Cisco released patches for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3, Secure Client, and Unified Communications products, including three hardening advisories that group 20 CVEs by weakness class, so one CVE can stand for several internally found issues. Cisco says the flaws were found in internal security testing using its existing processes as well as frontier AI models, that its PSIRT is not aware of exploitation in the wild, and that there are no workarounds. The highest scores sit in the voice stack: CVE-2026-76473, an injection class flaw, and CVE-2026-76474, an improper authentication flaw, both score 9.8 and are reachable over the network without authentication across Unified CM and related products, fixed in Release 15SU5, with Release 14 customers told to migrate. Expressway-C and Expressway-E take eight fixes in X15.5.20, and the Snort 3 detection engine tops out at 9.0 in CVE-2026-20043, fixed in Snort 3.12.4.0, with cloud firewall, Secure Access, and connected Meraki MX devices updated automatically.
Executives
None of these flaws is known to be exploited, which makes this a discipline test rather than an emergency. Voice systems and VPN gateways are easy to defer because upgrades touch daily operations, and that deferral is exactly how a no-exploitation advisory becomes next quarter's incident. Ask for a completion date per product family, not a single program status.
CIO / CISO
Sequence by reachability: the two 9.8 Unified Communications flaws need no credentials and sit on the network, so they go first, followed by Expressway at the network edge and then the Snort 3 engine that inspects traffic for other systems. Note the grouped-by-weakness scoring when you brief stakeholders: the advisory tables show the worst underlying bug in each class, so some figures differ from the per-CVE records, and the National Vulnerability Database had not scored them yet at publication.
Engineers
Upgrade Unified CM family products to Release 15SU5 or migrate off Release 14, move Expressway to X15.5.20, and take Snort 3 to 3.12.4.0 or the fixed train for your platform. Verify the cloud-delivered products actually received their automatic updates rather than assuming it, and remember Snort 2 is not affected, so do not spend the window patching the wrong engine.
Everyone (non-IT)
The phone system and the security scanner at work both appear in this release. Nothing here asks anything of individual users, but if IT schedules a voice or VPN maintenance window this week, this set of fixes is why it should not slip.