MDR
Solutions
Partners
About
Resources
Affected Environment
Cisco Expressway, Unified Communications products, Snort 3 based products, IOS XR ASR 9000, Secure Client, and products under PHP investigation.
Threat Overview
Critical flaws include Expressway root RCE CVE-2026-76466 and Unified CM issues CVE-2026-76473 and CVE-2026-76474, all CVSS 9.8.
Exposure Timeline
Advisories published 22 October 2026; Cisco is still investigating which products the PHP flaws affect.
Attack Surface
Expressway clustered database service, Unified CM web interfaces, Snort 3 detection engine, ASR 9000 IPv4 processing, and Secure Client IPC.
Technical Root Cause
Persistent cookies with weak certificate validation, improper authentication, resource lifecycle flaws, out-of-bounds writes, and improper input handling.
Exploitation Pathway
Unauthenticated remote attackers target Expressway clusters or send crafted packets; local attackers abuse IPC and control sockets.
Operational Impact
Root command execution on Expressway, Snort 3 engine restarts, line card resets, privilege escalation, and access control bypass.
Strategic Impact
Compromised collaboration, edge, and inspection infrastructure threatens communications and network visibility; all entity sizes rated Critical.
Required Mitigation
Upgrade to Cisco fixed releases, including Expressway X15.5.20, Unified CM 15SU5, and Snort 3 3.12.4.0; few workarounds exist.
Incident Response Guidance
Review system and authentication logs for privilege escalation, forward logs centrally, and track Cisco updates for products under PHP investigation.
References
Cisco Security Advisories, including cisco-sa-php-october26.
Trusted by clients worldwide
Led by human expertise and powered by the VisionX platform, we provide you with a 24/7 unbeatable Managed Detection & Response capability giving you transparent and consolidated security solutions.
.jpg)