Cisco vulnerabilities, week 43 of 2026: eight critical flaws lead 65 CVEs

The release at a glance

During the week of 19–25 October 2026, Cisco published advisories covering 65 CVEs in its product portfolio. The release includes eight critical, 25 high, 24 medium and eight unscored vulnerabilities. The affected products span Splunk Enterprise, Splunk SOAR, Cisco Expressway Series, Cisco Emergency Responder, Cisco Unified Communications Manager, Snort3, Cisco Cyber Vision, Cisco IOS XR and Cisco Secure Client.

Several of the critical and high-severity entries come from hardening releases: Splunk Enterprise and Splunk SOAR each received internally discovered fixes, and Cisco published a Unified Communications hardening release covering Emergency Responder, Unified CM, IM and Presence Service and Unity Connection. No CVE in this week's release is listed in CISA's Known Exploited Vulnerabilities catalogue, and Cisco PSIRT states it is not aware of public announcements or malicious use for the Expressway, Unified Communications and Snort3 advisories.

What matters most

Start with these eight vulnerabilities:

• Cisco Expressway Series — CVE-2026-76466 is a critical 9.8 unauthenticated remote code execution flaw in the database service. An attacker with network access could execute operating system commands as root on Expressway-C or Expressway-E devices.
• Splunk Enterprise — CVE-2026-76299, involving improper access control, and CVE-2026-76302, involving improper neutralisation, are both critical 9.9 hardening fixes with network attack vectors and low privilege requirements.
• Splunk SOAR — CVE-2026-76531 is a critical 9.9 issue involving files or directories accessible to external parties.
• Cisco Unified Communications products — CVE-2026-76473, CVE-2026-76474 and CVE-2026-76475 are critical flaws affecting Emergency Responder, Unified CM, IM and Presence Service, and Unity Connection.
• Cisco Open Source Snort3 — CVE-2026-20043 is a critical 9.0 out-of-bounds write addressed in Cisco's hardening release; it also affects Cisco Cyber Vision.

Several of these vulnerabilities have their own advisory page on this site.

Patch in this order

With no CISA KEV entries in this release, start with internet-facing and pre-authentication issues.

1. Cisco Expressway Series — CVE-2026-76466. Apply Cisco's fix first. This is unauthenticated remote code execution as root, so any Expressway-C or Expressway-E reachable from the network should be updated before anything else. The advisory does not list specific fixed versions.
2. Cisco Unified Communications hardening — CVE-2026-76473, CVE-2026-76474, CVE-2026-76475. Apply the Cisco hardening releases for Emergency Responder, Unified CM, IM and Presence Service and Unity Connection. Fixed version numbers are not stated; follow the advisory for your release train.
3. Splunk Enterprise. Update to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 to address CVE-2026-76299 and CVE-2026-76302. CVE-2026-76291 is also addressed by these releases. For CVE-2026-76298, the fixed versions are 10.4.4 and 10.2.8.
4. Splunk SOAR. Update to Splunk SOAR 8.7.0 for CVE-2026-76531 and CVE-2026-76530.
5. Cisco Open Source Snort3 and Cisco Cyber Vision — CVE-2026-20043. Apply Cisco's Snort 3 hardening release. Fixed version numbers are not stated in the advisory.
6. Then work the remaining high and medium CVEs in Emergency Responder, Expressway Series, IOS XR, Secure Client, Unified CM, Cyber Vision and the remaining Splunk entries, prioritising systems that are reachable from untrusted networks.

Beyond the patch

Large multi-product Cisco releases are more manageable when you know which services are exposed and which suppliers' patch cycles stretch your exposure window. Virtual CISO Services (vCISO) can keep that exposure view current, because reachable services and open ports are what exposure management catches; Supply Chain Defense & Third-Party Risk helps track the Cisco and Splunk software you rely on and the risk of waiting on vendor fixes.