Key points
- Cisco PSIRT released security hardening updates for Snort 3, Expressway Series, and Unified Communications products in October 2026.
- The updates address multiple internally discovered vulnerabilities, including critical out-of-bounds writes tracked by CVE-2026-20043.
- These flaws are not known to be actively exploited, and no workarounds are available; users must apply the software updates.
Cisco’s Product Security Incident Response Team released security hardening updates for Snort 3, the Expressway Series, and several Unified Communications products on October 21, 2026. These releases address multiple internally discovered vulnerabilities found during comprehensive internal security reviews. The engineering teams grouped these issues by their underlying Common Weakness Enumeration classes and assigned a single Common Vulnerabilities and Exposures identifier to each grouping to streamline the disclosure process.
The most severe issue, tracked as CVE-2026-20043, involves out-of-bounds writes classified under CWE-787. The National Vulnerability Database rates this flaw as critical with a CVSS score of 9.0. This vulnerability affects Cisco Secure Firewall Threat Defense Software, Unified Threat Defense on Cisco IOS XE Software, and various versions of Open Source Snort 3. Cisco confirmed that these vulnerabilities do not affect Open Source Snort 2, which has reached end of life.
What we know
The Expressway Series hardening release addresses vulnerabilities in both Cisco Expressway Core and Cisco Expressway Edge devices, covering both virtual and appliance versions. According to the advisory, these flaws include incorrect permission assignment for critical resources, improper control of code generation, and improper link resolution before file access. The security impact rating for the Expressway Series update is high.
The Unified Communications hardening release covers Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, its IM & Presence Service, Session Management Edition, and Cisco Unity Connection. Like the other products, these vulnerabilities were found during internal testing and are not known to be actively exploited. Cisco stated that no workarounds are available for any of these vulnerabilities.
Defender's checklist
- Verify if your environment runs vulnerable versions of Cisco Secure Firewall Threat Defense or Unified Threat Defense software.
- Check whether your Expressway Core or Edge devices are running unsupported software releases.
- Confirm that your Unified Communications Manager and related services are not listed in the vulnerable product section.
- Ensure that Open Source Snort 2 is not being used in production, as it is end of life and unsupported.
What analysts watch for
Teams usually monitor for unusual memory access patterns that might indicate out-of-bounds write attempts. Analysts should examine logs for unexpected code execution or permission escalation events on network security appliances. Check whether any services are behaving erratically or crashing unexpectedly, which could signal exploitation attempts. Review file access logs for suspicious link following or resolution anomalies. Monitor for any new indicators of compromise related to these specific CVEs in threat intelligence feeds.
Background: Indicators of attack
Indicators of attack focus on what an adversary is doing right now, such as executing suspicious commands or modifying system files. Unlike static indicators, they adapt to evolving tactics, allowing defenders to detect novel threats that bypass traditional signature-based tools.
Read the full guide: Indicators of Attack: Why Context Beats Signatures
What to do and how to stay safe
- Review the fixed software sections in the Cisco advisories to identify the specific update versions required for your environment.
- Schedule maintenance windows to apply the software updates to all affected Snort 3, Expressway, and Unified Communications devices.
- Monitor system logs for any signs of exploitation attempts while planning the patch deployment, as no workarounds exist.
- Verify that all virtual and appliance versions of Expressway devices are included in the update plan.
Step-by-step guide: Threat Intelligence Program Checklist for Secure Operations
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Are these vulnerabilities being actively exploited?
No, Cisco stated that these vulnerabilities were found during internal testing and are not known to be actively exploited
