Cisco Snort 3, Expressway, and UC Flaws Require Immediate Patching

Cisco published security hardening releases on October 21, 2026, for its Snort 3, Expressway Series, and Unified Communications products. These updates address multiple internally discovered vulnerabilities found during comprehensive security reviews by Cisco engineering teams. The company stated that these flaws were identified through internal testing and are not currently known to be exploited by threat actors.

The risk

The most severe issue, tracked as CVE-2026-20043, involves out-of-bounds write errors classified under CWE-787. The National Vulnerability Database rates this vulnerability as critical with a CVSS score of 9.0. Cisco grouped multiple underlying flaws by their Common Weakness Enumeration class and assigned a single CVE ID to each group to streamline the patching process for customers.

Who is exposed

Cisco Secure Firewall Threat Defense Software and Unified Threat Defense on Cisco IOS XE are affected by the Snort 3 vulnerabilities. Cisco Expressway Core and Expressway Edge devices, in both virtual and appliance forms, are exposed to the flaws in the Expressway Series. Additionally, several Unified Communications products, including Cisco Unified CM and Cisco Unity Connection, require updates.

Cost and compliance

Cisco confirmed that Open Source Snort 2 is not affected by these specific vulnerabilities, though that product has reached end of life. The vendor noted that it may publish separate advisories later to provide additional details about individual vulnerabilities within these hardening releases. The current advisories cover the broad vulnerability classes addressed in the October 2026 updates.

What happens next

Cisco strongly recommends that customers upgrade to the fixed software versions indicated in the advisories to remediate these vulnerabilities. Because there are no workarounds available, organizations relying on the affected products must apply the software updates to avoid potential exposure. The PSIRT validates only the affected and fixed release information documented in the official notices.

Questions to ask your suppliers

Organizations should ask their managed service providers whether the Cisco infrastructure supporting their network or communications has been updated to the hardened versions. Internal IT teams need to verify that all Expressway and Unified Communications appliances are running the patched software. Security operations centers should confirm that firewall threat defense modules are current. Management should be informed of any systems that cannot be patched immediately due to operational constraints, so compensating controls can be evaluated.

Background: Firewalls

Firewalls are important because they enforce access policies at network boundaries, blocking unauthorized traffic before it reaches your devices. Without this filter, your systems face constant probing. This reduces the attack surface and prevents automated exploits from finding vulnerable services.

Read the full guide: Why Firewalls Are Important: The Hidden Costs of Missing Filters

What to do and how to stay safe

• Inventory all Cisco Snort 3, Expressway, and Unified Communications devices to identify those running vulnerable software versions.
• Apply the latest software updates provided by Cisco to remediate the out-of-bounds write and other flaws.
• Monitor network traffic for unusual activity while ensuring all systems are updated, as no workarounds exist.
• Verify that any third-party integrations or managed services using these Cisco products have also applied the fixes.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-20043 being actively exploited?

No, Cisco stated that these vulnerabilities were found during internal testing