Cisco week 43 2026: Splunk, Expressway and UC hardening lead 65 CVEs

The release at a glance

During the week of 19–25 October 2026, Cisco published 65 vulnerabilities, all with CVE identifiers. By severity, 8 are critical, 25 high, 24 medium and 8 unscored. The release is concentrated in Cisco and Splunk product lines: 16 CVEs affect Splunk Enterprise, 15 affect Splunk SOAR, 10 affect Cisco TelePresence Video Communication Server (VCS) Expressway, and 8 each affect Cisco Emergency Responder and Cisco Open Source Snort3. Smaller counts affect Cisco Cyber Vision, Cisco IOS XR Software, Cisco Secure Client and Cisco Unified Communications Manager.

None of the 65 CVEs appears in CISA's Known Exploited Vulnerabilities catalogue, and for the issues where Cisco PSIRT has commented, it says it is not aware of public announcements or malicious use. This is primarily a hardening and patch-planning release rather than an active compromise response.

What matters most

Splunk Enterprise. CVE-2026-76299 and CVE-2026-76302 are critical 9.9 hardening flaws involving improper access control and improper neutralisation. They are fixed in Splunk Enterprise 10.4.4, 10.2.8, 10.0.11 and 9.4.16.

Splunk SOAR. CVE-2026-76531 is a critical 9.9 flaw allowing files or directories to be accessible to external parties. It is fixed in Splunk SOAR 8.7.0.

Cisco TelePresence Video Communication Server (VCS) Expressway. CVE-2026-76466 is an unauthenticated remote code execution vulnerability with a CVSS score of 9.8. It allows root-level command execution through the database service. The advisory states fixes are available but does not list specific fixed versions.

Cisco Unified Communications products. CVE-2026-76474, CVE-2026-76473 and CVE-2026-76477 affect Cisco Emergency Responder, Cisco Unified Communications Manager, Unified CM IM and Presence Service and Cisco Unity Connection. They cover improper authentication, improper resource control and SQL injection. Fixes are available; fixed versions are not stated.

Cisco Open Source Snort3. CVE-2026-20043 is a critical 9.0 out-of-bounds write affecting Snort3, Cisco Cyber Vision, Cisco Secure Firewall Threat Defense and Cisco UTD SNORT IPS Engine Software. Fixes are available; fixed versions are not stated.

Patch in this order

1. Patch Cisco Expressway Series first if any device is reachable from untrusted networks. CVE-2026-76466 gives unauthenticated root command execution; Cisco's advisory indicates fixes are available, but specific fixed versions are not listed, so confirm the appropriate release with Cisco before scheduling.
2. Patch Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16 for CVE-2026-76299, CVE-2026-76302, CVE-2026-76291 and CVE-2026-76298. The last of these is fixed only in 10.4.4 and 10.2.8.
3. Patch Splunk SOAR to 8.7.0 for CVE-2026-76531 and CVE-2026-76530.
4. Patch Cisco Emergency Responder, Unified Communications Manager, Unified CM IM and Presence Service and Unity Connection for CVE-2026-76474, CVE-2026-76473, CVE-2026-76475 and CVE-2026-76477. Fixes are available; fixed versions are not stated.
5. Patch Cisco Open Source Snort3, Cisco Cyber Vision, Secure Firewall Threat Defense and UTD SNORT IPS Engine for CVE-2026-20043. Fixes are available; fixed versions are not stated.
6. Then move through the remaining high, medium and unscored CVEs, prioritising Expressway, Cyber Vision and Splunk deployments that are network-adjacent or hold sensitive data.

Beyond the patch

Most of the risk in this release is about knowing what you run and patching in the right order. Supply Chain Defense & Third-Party Risk helps track which Cisco and Splunk products are in your estate and how quickly the vendor fixes them; Virtual CISO Services (vCISO) takes the internet-facing, unauthenticated items such as the Expressway RCE and turns them into a prioritised patch plan.