Cisco's October hardening releases cover 20 CVEs, including critical bugs in Unified CM and Snort 3

Cisco has published three hardening advisories covering 20 CVEs across its voice and collaboration software, its Expressway Series and Snort 3, the intrusion engine inside several Cisco security products.

Cisco groups flaws by weakness class. Each CVE covers a Common Weakness Enumeration (CWE) class rather than a single bug, so one CVE can stand for several internally found issues. Cisco says the vulnerabilities were found in internal security testing, using its existing processes as well as frontier AI models. Its PSIRT is not aware of public announcements or malicious use, and there are no workarounds.

Two voice flaws score 9.8. The voice advisory carries eight CVEs, CVE-2026-76473 through CVE-2026-76479 plus CVE-2026-76481. Cisco as the CNA scores CVE-2026-76473 (CWE-74, an injection class) and CVE-2026-76474 (improper authentication) at 9.8 under CVSS 3.1, both network-reachable without authentication. CVE-2026-76475, a cross-site scripting class, scores 9.3. Three CVEs score 8.8: SQL injection and input-validation classes over the network, and an access-control class that needs local access. A path-traversal class scores 7.8 and an exception-handling class 7.5. Affected products are Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM Session Management Edition and Unity Connection. Release 15SU5 carries the fixes; release 14 customers must migrate to a fixed release.

Expressway gets eight fixes. CVE-2026-76490 through CVE-2026-76497 affect Expressway-C and Expressway-E, virtual and appliance, regardless of configuration. In the CVE records, Cisco scores CVE-2026-76490, an out-of-bounds write class, highest at 8.6, followed by three denial-of-service classes at 7.5 and four local flaws scored 7.8, 7.8, 7.0 and 6.6. The advisory's own table lists higher figures for some of them (8.6 for the three denial-of-service CVEs, 7.8 for all four local ones) because it shows the worst-case score of any single bug within each weakness class. The fix is X15.5.20; X14 and earlier must migrate.

Snort 3 tops out at 9.0. The Snort 3 advisory covers CVE-2026-20043, an out-of-bounds write class Cisco scores 9.0, along with CVE-2026-20291 (local privilege management, 7.8) and CVE-2026-20236 (incorrect calculation) and CVE-2026-20356 (resource consumption), each scored 7.5 in its CVE record. The advisory table lists CVE-2026-20236 at 9.0, its worst-case score for any bug in that class. Affected products are Open Source Snort 3, Cyber Vision, Secure Firewall Threat Defense, UTD on IOS XE, Meraki MX, Cloud-delivered Firewall and Secure Access. Fixes land in Snort 3.12.4.0 and Cyber Vision 5.6.0, with FTD and IOS XE fixes listed per train. Cisco says cloud firewall, Secure Access and connected Meraki MX devices were updated automatically. Cisco confirms Snort 2 is not affected.

NVD has not scored them yet. All scores above are the per-CVE scores Cisco published as the CNA in the CVE records. The advisories' summary tables show the highest score of any underlying bug in each weakness class, so some figures there are higher. The National Vulnerability Database lists the CVEs as awaiting analysis.