Orgs urged to patch Cisco Snort 3, Expressway, UC for CVE-2026-20043 out-of-bounds writes

Cisco released security hardening updates for Snort 3, the Expressway Series, and several Unified Communications products on October 21, 2026. These releases address multiple vulnerabilities discovered during internal security reviews by Cisco engineering teams. The company stated that these flaws are not known to be actively exploited in the wild. Customers using the affected software versions are advised to apply the available updates to remediate the risks.

Which products are affected?

The Snort 3 hardening release affects Cisco Secure Firewall Threat Defense (FTD) Software and Unified Threat Defense (UTD) on Cisco IOS XE Software. According to the advisory, Open Source Snort 2 is not affected, though it has reached End of Life. The NVD record for CVE-2026-20043 also lists Cisco Cyber Vision and specific Open Source Snort3 versions as affected components.

What flaws were fixed?

CVE-2026-20043 addresses out-of-bounds write issues classified under CWE-787. The Expressway Series update resolves incorrect permission assignments, code injection problems, and improper link resolution. The Unified Communications update covers Emergency Responder, Prime Collaboration Deployment, Unified CM, and Unity Connection. Cisco grouped these issues by underlying vulnerability class to streamline the disclosure process.

How severe are these issues?

The NVD records CVSS 9.0 for CVE-2026-20043, rating it critical. The Cisco advisory for the Expressway Series assigns a high security impact rating. Cisco states that the CVSS score assigned to each CVE ID represents the maximum potential severity of the single most impactful underlying vulnerability within that specific Common Weakness Enumeration category.

What is the recommended action?

Cisco strongly recommends that customers upgrade to the fixed software indicated in the respective advisories. There are no workarounds available for these vulnerabilities. The company has released software updates for all affected products. Administrators should verify their current software versions against the fixed release lists provided in the official Cisco security advisories.

What analysts watch for

Security teams monitoring for similar hardening releases should examine internal logs for unusual memory access patterns or unexpected application crashes. Analysts typically review configuration files for permission anomalies or suspicious link resolutions in file access paths. Teams usually check whether legacy components like Snort 2 remain in production,

Background: CVSS score

The Common Vulnerability Scoring System assigns a numerical value to software flaws based on how easy they are to exploit and how much damage they cause. It uses a standardized formula so teams can compare risks across different products. The base score reflects the vulnerability itself, while temporal and environmental scores adjust for real-world conditions like patches or network exposure.

Read the full guide: CVSS Score Explained: What the Number Actually Means for Your Code

What to do and how to stay safe

• Scanners rely on known signatures and cannot detect novel logic errors or business rule bypasses.
• Active scanning generates traffic that can disrupt services or trigger false positives in production environments.
• Regular scanning improves visibility into known risks but does not replace secure coding practices or penetration testing.

Vulnerability scanning identifies known technical flaws but cannot detect logic errors or novel attacks. Combine automated scans with manual testing and context-aware prioritization to manage risk effectively.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.