/
← Voltar ao feed
high

Cisco October 2026 patches: Snort 3 fixes (CVE-2026-20043 and others) in a 34-vulnerability bundle with critical Expressway RCE

2 fonte(s) · 2 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 1 dia

Cisco's Open Source Snort 3 engineering team released software hardening updates for multiple vulnerabilities found during an internal security review, as part of Cisco's October 21, 2026 advisory bundle. The issues are grouped by Common Weakness Enumeration class, with one CVE ID per group. CVE-2026-20043 covers out-of-bounds writes (CWE-787). The advisory lists CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356 as well and gives the Security Impact Rating as Critical. Cisco states the flaws were found in internal testing and are not known to be actively exploited. SecurityWeek (securityweek.com) places the Snort 3 fixes within a bundle of 34 vulnerabilities across Expressway Series, IOS XR, Snort 3 and Unified Communications products, and reports 13 Snort 3 CVEs fixed in Snort 3 3.12.4.0 and in updates for other Cisco products.

Entenda a falha

A vulnerabilidade

Cisco's Snort 3 team fixed 13 internally found CVEs (per SecurityWeek), grouped by weakness class, one CVE per class. The advisory lists CVE-2026-20043 (out-of-bounds write, CWE-787), CVE-2026-20236 (critical incorrect calculation, per SecurityWeek), CVE-2026-20291 and CVE-2026-20356, and rates the impact Critical. SecurityWeek also mentions high-severity privilege management, resource consumption and arbitrary command execution bugs. Fixes are in Snort 3 3.12.4.0 and in updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, FMC, FTD and UTD for IOS XE. The articles give no attacker requirements, and there are no workarounds. In the same bundle, the critical Expressway RCE CVE-2026-76466 gives root command execution and is fixed in X15.5.20.

Como funciona

The articles do not describe how the Snort 3 flaws are reached or the code path involved, and no attack vector is given. For the out-of-bounds write class, the general mechanism is that the software writes data past the bounds of a memory buffer. For the Expressway bug, Cisco says that persistent cookies plus insufficient client certificate validation in certain configurations let an attacker connect to the database service and invoke specific RPC commands, which leads to commands running as root.

Por que é vulnerável

Cisco groups the Snort 3 issues by weakness class, so each CVE stands for several bugs of the same type, such as out-of-bounds writes (CWE-787) and incorrect calculations. The articles do not explain the individual root causes or why they went unnoticed before the internal review. For the Expressway RCE, the causes named are the use of persistent cookies and insufficient validation of client certificates in certain configurations. The fix is shipped as hardening releases, and the articles do not detail what changes in the code.

Como foi descoberta

According to Cisco, the Cisco-owned open-source Snort 3 engineering team found the vulnerabilities during a comprehensive internal security review and internal testing. Cisco says they are not known to be actively exploited, and SecurityWeek repeats that for the whole bundle. They were disclosed on October 21, 2026 in a Cisco advisory that is part of a group of advisories, with one CVE per weakness class. Cisco notes it may publish separate advisories with details on individual bugs.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 08:17.

Detalhes técnicos

  • CVE-2026-20043 is a CWE-787 (out-of-bounds write) class issue in Snort 3.
  • CVE-2026-20236 is described by securityweek.com as a critical-severity incorrect calculation issue, alongside CVE-2026-20043 (out-of-bounds write).
  • The advisory lists four CVEs in total: CVE-2026-20043, CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356. Only CVE-2026-20043 was initially mapped to a weakness class in the text.
  • According to securityweek.com, the Snort 3 fixes also cover high-severity privilege management, resource consumption and arbitrary command execution bugs and medium-severity issues. They are included in Snort 3 3.12.4.0 and in security updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD and UTD for IOS XE (securityweek.com).
  • The wider bundle (securityweek.com) includes the critical Expressway Series RCE CVE-2026-76466 (fixed in X15.5.20), critical UC flaws CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475, the high-severity IOS XR DoS CVE-2026-76505 and the Secure Client privilege escalation CVE-2026-76462.
  • Cisco may publish separate advisories with details on individual vulnerabilities.
  • No exploitation in the wild is reported, and no attack vector details are given for the Snort 3 flaws.

Remediação

  • Apply the software updates Cisco has released, including Snort 3 3.12.4.0 or later and the updates for the other affected Cisco products (securityweek.com).
  • No workarounds exist.
  • Consult the Cisco Advance Notification for the October 21, 2026 advisories for the full list of related advisories.

Relatos divergentes

  • The Cisco advisory text, as summarised earlier, lists four Snort 3 CVEs (CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356), while securityweek.com reports 13 CVEs affecting Snort 3. The securityweek.com figure covers the full bundle and is the more recent and complete count.

Linha do tempo

  1. securityweek.com ↗ · pub. 22/10/2026 07:05 · coletado 22/10 08:00

    Cisco patches 34 vulnerabilities, including critical Expressway RCE CVE-2026-76466, across Expressway, IOS XR, Snort 3 and UC products

    This roundup widens the scope of the known Snort 3 update: SecurityWeek reports 13 Snort 3 CVEs, not four, fixed in Snort 3 3.12.4.0 and in updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, FMC, FTD and UTD for IOS XE. It describes CVE-2026-20236 as an incorrect calculation issue and also covers 21 other Cisco CVEs, including the critical Expressway RCE CVE-2026-76466.

    ler a análise desta fonte

    This roundup widens the scope of the known Snort 3 update: SecurityWeek reports 13 Snort 3 CVEs, not four, fixed in Snort 3 3.12.4.0 and in updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, FMC, FTD and UTD for IOS XE. It describes CVE-2026-20236 as an incorrect calculation issue and also covers 21 other Cisco CVEs, including the critical Expressway RCE CVE-2026-76466.

    Cisco announced patches on October 21, 2026 for 34 vulnerabilities across Expressway Series, IOS XR, Snort 3 and Unified Communications products. The most notable is CVE-2026-76466, a critical remote code execution flaw in Expressway Series that allows command execution as root. Cisco says it is not aware of exploitation in the wild for any of the issues. Several other critical-severity CVEs were fixed in Unified Communications products and in Snort 3 and the Cisco products that embed it.

    Technical Details

    • Expressway Series (10 vulnerabilities): CVE-2026-76466 is a critical RCE. Persistent cookies and insufficient validation of client certificates in certain configurations could let an attacker connect to the database service and invoke specific RPC commands, leading to arbitrary command execution as root. It is fixed in version X15.5.20, which also resolves eight CVEs that group multiple vulnerabilities by CWE category and one medium-severity information disclosure bug.
    • Unified Communications (9 CVEs; Emergency Responder, Prime Collaboration Deployment, CM, CM IM&P, CM SME, Unity Connection): CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475 are critical and group improper resource control, improper authentication and improper input neutralization issues.
    • Snort 3 (13 CVEs): includes CVE-2026-20236 and CVE-2026-20043, which group critical-severity incorrect calculation and out-of-bounds write issues. The fixes also cover high-severity privilege management, resource consumption and arbitrary command execution bugs, plus medium-severity issues. They ship in Snort 3 3.12.4.0 and in updates for Cyber Vision, CDFW, Meraki MX, CSA, Secure Firewall ASA, Secure FMC, Secure FTD and UTD for IOS XE.
    • IOS XR: CVE-2026-76505, a high-severity denial-of-service flaw.
    • Secure Client (Secure Firewall Posture module): CVE-2026-76462, a high-severity privilege escalation.

    Remediation

    • Upgrade Expressway Series to X15.5.20 or later and Snort 3 to 3.12.4.0 or later.
    • Apply the security updates for the affected UC, IOS XR, Secure Client and other listed products.
    • Consult Cisco's security advisories page and its October 21 notification for per-product fixed releases.
  2. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:00 primeiro registro só resumo do feed

    Cisco releases Snort 3 hardening updates fixing internally found out-of-bounds write flaws (CVE-2026-20043 and three others)

    ler a análise desta fonte

    Cisco's Open Source Snort 3 engineering team released software hardening updates for multiple vulnerabilities found during an internal security review, as part of Cisco's October 21, 2026 advisory bundle. The issues are grouped by Common Weakness Enumeration class, with one CVE ID per group. CVE-2026-20043 covers out-of-bounds writes (CWE-787). The advisory lists CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356 as well and gives the Security Impact Rating as Critical. Cisco states the flaws were found in internal testing and are not known to be actively exploited.

    Technical Details

    • CVE-2026-20043 is a CWE-787 (out-of-bounds write) class issue in Snort 3.
    • The advisory lists four CVEs in total: CVE-2026-20043, CVE-2026-20236, CVE-2026-20291 and CVE-2026-20356. Only CVE-2026-20043 is mapped to a weakness class in the text.
    • Cisco may publish separate advisories with details on individual vulnerabilities.
    • No exploitation in the wild is reported, and the article gives no attack vector or affected version details.

    Remediation

    • Apply the software updates Cisco has released.
    • No workarounds exist.
    • Consult the Cisco Advance Notification for the October 21, 2026 advisories for the full list of related advisories.