Fix guides / Security notices

Security notice

Use Cisco firewalls or phone systems? Cisco fixed critical flaws. Plan the update.

Last updated: Friday, October 23, 2026, 10:16 AM ETStatus: Fixes released. No attacks reported. Update in your next maintenance window.

On October 21, 2026, Cisco released fixes for critical flaws in three groups of products. Snort 3, the threat inspection engine inside Cisco Secure Firewall Threat Defense, Meraki MX security appliances, some Cisco routers and other Cisco products, has two groups of flaws rated 9.0 out of 10. Cisco Expressway, which connects Cisco calling and video systems to the internet, has a flaw rated 9.8 out of 10 that could let an attacker with no login run commands as root on systems set up in a cluster. Cisco Unified Communications Manager and related phone system products have flaws rated up to 9.8. Cisco says it is not aware of anyone exploiting any of them, and there are no workarounds. None of this affects your website or online store directly. If you or an IT provider run any of these Cisco products, install the fixes in your next maintenance window.

What happened

Cisco now publishes most of its security fixes on a set schedule, the first and third Wednesday of each month. On Wednesday, October 21, it published fixes for Snort 3, Expressway, its Unified Communications phone products, IOS XR and Secure Client. Three of those advisories are rated critical. (Cisco)

Who should worry

This is not a problem with your website or online store, and your site visitors are not at risk from it. It is about the equipment that protects your office network and runs your business phones. Most small businesses that use these products have an IT provider or MSP looking after them.

Ask about this if any of these are true:

Meraki MX, Cisco Cloud-delivered Firewall and Cisco Secure Access customers need do nothing. Cisco says that as of October 21, all of those cloud instances, and all listed Meraki MX models that are online and connected to the Meraki Dashboard, were updated automatically. If a Meraki MX has been offline, make sure it is back online. Cisco says Open Source Snort 2 is not affected. (Cisco)

What to do now

Plan these for your next maintenance window.

  1. Ask the question. Send the message below to your IT provider, MSP or IT person. You need a clear yes or no: do we use any of the Cisco products in this notice, and when will they be on a fixed version?
  2. Update firewalls and routers that use Snort 3 to the fixed releases listed below. (Cisco)
  3. Update clustered Expressway systems to X15.5.20. X14 and older need to move to a fixed release. (Cisco)
  4. Update Unified CM and the other phone system products to 15SU5. Release 14 has no fix and needs to move to a fixed release. (Cisco)
  5. If your next window is weeks away, ask about Expressway and the phone system first. Those flaws are rated 9.8 and have no workaround, so it is worth asking whether they can go sooner.
  6. If the answer is "I don't know", that is not a no. Ask them to check.

What to send your IT provider, MSP or IT person

On October 21, 2026, Cisco released critical fixes for Snort 3 (CVE-2026-20043 and CVE-2026-20236, CVSS 9.0), Cisco Expressway (CVE-2026-76466, CVSS 9.8, clustered systems) and its Unified Communications products (hardening release, CVSS up to 9.8). Cisco says none are known to be exploited and there are no workarounds. Please confirm whether we use any of these: Secure Firewall Threat Defense, Unified Threat Defense on IOS XE, Cyber Vision, Expressway-C or Expressway-E, Unified CM, Unity Connection, Emergency Responder or Prime Collaboration Deployment. If we do, please schedule the fixed releases from Cisco's advisories in the next maintenance window, with Expressway and the phone system first, and tell us when it is done. Sources: Cisco Snort 3 advisory, Cisco Expressway advisory, Cisco Unified Communications advisory.

Technical steps

Step 1. Snort 3 products: install the first fixed release

(Cisco)

Step 2. Expressway: check for a cluster, then upgrade

CVE-2026-76466 affects Expressway-C and Expressway-E, virtual and appliance, only when they are set up in a cluster. X15.5.3 and earlier: upgrade to X15.5.20. X14 and earlier: move to a fixed release. Cisco also published a separate Expressway hardening release, rated up to 8.6, so ask whoever runs Expressway to check that advisory too, even if your systems are not clustered. (Cisco)

Step 3. Unified Communications products: upgrade to 15SU5

Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM and Presence, Unified CM SME and Unity Connection: release 15: 15SU5. Release 14: move to a fixed release. (Cisco)

Step 4. Until you can patch

Cisco says there are no workarounds for any of these. As general good practice, keep management interfaces and the Expressway cluster connections reachable only from trusted networks, and keep the window short. That narrows the risk but does not close the flaws.

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. Cisco says it is not aware of anyone exploiting these flaws, and they were not on the US CISA list of known exploited flaws in the latest version we checked, dated October 21, 2026. (Cisco, CISA) That can change, which is why the fixes are worth scheduling now.

Can EverThread tell me if I am affected?

No. EverThread checks websites from the outside, the way a browser sees them. We do not test for these Cisco flaws, and we do not scan firewalls, routers or phone systems, so we cannot tell whether yours are on a fixed version. Whoever manages your Cisco equipment can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

We use Meraki. Do we need to do anything?

Probably not. Cisco says all listed Meraki MX models that are online and connected to the Meraki Dashboard were updated automatically as of October 21. If one has been offline, bring it back online so it gets the update. (Cisco)

Why is this not marked "update today" like other notices?

Because the facts are different. Cisco found most of these itself, says no one is known to be exploiting them, and they do not touch your website or store. The fixes still matter, so schedule them, but there is no sign of attacks to rush ahead of.

Where can I follow official updates?

Cisco's October 21, 2026 advisory list links to every advisory, and each one shows any revisions. (Cisco)

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

We email you a link to confirm first, and every alert has a one-click unsubscribe. Alerts can include a short note about EverThread. Already a customer? Use your account email and your alerts include a link to your dashboard. Privacy

Sources

While you are here

Check your site's other basics free. We look at your home page the way a browser does and tell you in plain English. This scan does not check Cisco firewalls, routers or phone systems for the flaws above. No account.

Or sign up free and we check it every day and email you when something changes.