Cisco Patches Critical RCE and Auth Bypass Flaws in Expressway, UC, and Snort 3

Cisco has released security updates addressing 34 vulnerabilities across its Expressway Series, IOS XR, Snort 3, and Unified Communications product lines. The most severe issues include critical-severity remote code execution and authentication bypass flaws that could allow attackers to compromise device integrity. According to SecurityWeek, these patches cover a wide range of network and communication infrastructure components.

Root cause

The critical remote code execution vulnerability in Expressway Series, identified as CVE-2026-76466, stems from insufficient validation of client certificates. Cisco notes that in certain configurations, attackers could leverage persistent cookies to connect to the database service. This access allows them to invoke specific remote procedure call commands, leading to arbitrary command execution as root on the underlying operating system.

Attack path

Exploitation of the Expressway flaw requires an attacker to connect to the database service using manipulated client certificates. Once connected, the attacker invokes remote procedure call commands to execute arbitrary system commands. In Unified Communications products, critical issues involve improper resource control and authentication failures. Snort 3 flaws include incorrect calculations and out-of-bounds write errors that could lead to privilege escalation or denial of service.

Affected versions

• Expressway Series versions prior to X15.5.20
• Snort 3 versions prior to 3.12.4.0
• Various Unified Communications Manager and related services
• IOS XR and Secure Client modules with specific CVEs

Mitigation

• Update Expressway Series to version X15.5.20 or later.
• Upgrade Snort 3 to version 3.12.4.0 or apply relevant security updates.
• Apply patches to affected Unified Communications Manager and IM&P services.
• Update IOS XR and Secure Firewall Posture modules to address DoS and privilege escalation flaws.

Signals worth monitoring

Teams usually check for unexpected remote procedure call activity on database services, which may indicate exploitation of certificate validation flaws. Monitor for unusual root-level command executions on network appliances, as this often signals successful remote code execution. Look for failed authentication attempts followed by successful logins from unauthorised sources, particularly on Unified Communications endpoints.

Check system logs for out-of-bounds memory access errors or abnormal resource consumption patterns in intrusion prevention systems. Containment moves typically involve isolating affected devices from the network to prevent lateral movement while patching is applied. Verify that client certificate validation policies are strictly enforced to block unauthorised database connections.

Background: Privilege escalation attacks

Prevent privilege escalation by enforcing least privilege, auditing service accounts, and validating file permissions. Secure temporary directories, restrict kernel module loading, and monitor for unexpected process creations. Regularly review group memberships and disable unused administrative roles to close common attack vectors before they are exploited.

Read the full guide: Privilege Escalation Attack Prevention Checklist for Secure Systems

What to do and how to stay safe: Cisco

• Inventory all Expressway, Unified Communications, and Snort 3 deployments to identify unpatched versions.
• Priorise patching devices exposed to untrusted networks or handling sensitive client certificates.
• Review firewall rules to restrict direct access to database services on communication appliances.
• Monitor for anomalous remote procedure call traffic until all systems are updated.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is there evidence of these vulnerabilities being exploited in the wild?

Cisco states it is not aware of any of these vulnerabilities being exploited in the wild.

Which Cisco products are affected by the critical remote code execution flaw?

The critical RCE flaw CVE-2026-76466 affects the Expressway Series.

What version of Snort 3 fixes the critical calculation and write issues?

Snort 3 version 3.12.4.0 includes fixes for these critical-severity issues.