# Cisco patches dozens of flaws across product line

Published: 2026-10-22 · Severity: elevated
Canonical: https://vorant.io/reports/10b23403-8e16-59cb-9f2e-9c9137c4dde0/cisco-patches-dozens-of-flaws-across-product-line

> CERT-FR details 26 Cisco CVEs spanning IOS XR/XE, Secure FTD, Unified CM, Expressway, Snort 3 and Secure Client with no confirmed in-the-wild exploitation yet.

CERT-FR has published a consolidated advisory (CERTFR-2026-AVI-1360) covering eight Cisco security bulletins released on 21-22 October 2026, affecting a wide range of Cisco products including IOS XE and IOS XR software (ASR9k platforms), Secure FTD, Unified Communications Manager and related voice/collaboration products, Expressway Series, Secure Client, Cyber Vision, and Snort 3. Collectively, the flaws could allow a remote attacker to execute arbitrary code, escalate privileges, cause denial of service, bypass security policy, or compromise data confidentiality and integrity, depending on the specific product and vulnerability.

Affected versions are extensive: IOS XE releases prior to 17.12.8/17.15.6/17.18.5/26.1.2/26.2.1; IOS XR releases across the 7.x, 24.x branches prior to their respective fixed versions and SMUs; Secure FTD 7.x and 10.x branches prior to patched builds; Unified CM family and Unity Connection prior to 15SU5; Expressway Series prior to X15.5.20; Secure Client prior to 5.1.20.333; Cyber Vision prior to 5.6.0; and Snort 3 prior to 3.12.4.0. One bulletin (cisco-sa-vcs-static-cred) references static/default credential issues on Expressway/VCS, and another (cisco-sa-sec-client-priv-esc) covers a Secure Client privilege escalation flaw.

No exploitation in the wild is reported by CERT-FR; the advisory is a vulnerability/patch notice, directing administrators to Cisco's own PSIRT bulletins for authoritative details and fixed releases. Defenders running any of the listed Cisco products should inventory affected versions, prioritize patching internet-facing components (IOS XE/XR routers, FTD firewalls, Expressway/VCS gateways), and review Cisco's advisories for CVE-specific exploitability and mitigation guidance.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (templated), CVE-2026-109619, CVE-2026-20043, CVE-2026-20236, CVE-2026-20291, CVE-2026-20356, CVE-2026-76462, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497, CVE-2026-76505, CVE-2026-76524

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1360

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/10b23403-8e16-59cb-9f2e-9c9137c4dde0/cisco-patches-dozens-of-flaws-across-product-line.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup