Cisco Unified CM and Snort 3: Four Critical CVEs From an Internal Review

On October 21, 2026, Cisco published four critical CVEs to NVD that are unusual in where they come from. Not an outside researcher, not observed exploitation: they are the output of internal security reviews Cisco ran on two product families, its unified communications platform (Unified CM and related products) and the open source detection engine Snort 3. Those reviews produced "hardening releases" that, in Cisco's words, address multiple internally discovered vulnerabilities.

What should catch your eye: two of these CVEs are rated 9.8, with a vector requiring no authentication and no user interaction. And the published descriptions say almost nothing about how they work.

The four CVEs

All scores come from Cisco acting as CNA (psirt@cisco.com). All four CVEs are Awaiting Analysis in NVD: no CPE configuration, no version range.

Per the NVD description, the "voice platform" products are Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Unified CM IM & Presence Service, Unified CM Session Management Edition and Cisco Unity Connection.

What the descriptions say, and what they leave out

The three voice platform CVEs share one text: a comprehensive internal review, hardening releases, then a single sentence tying the CVE to a weakness category. No component name, no entry point, no parameter. That is deliberate: Cisco groups several internal findings under each identifier and points to its advisory for the rest.

CVE-2026-76474: improper authentication, 9.8

An authentication flaw scored with no privileges, no interaction and full impact on confidentiality, integrity and availability: that is the profile of a remote takeover of the server running the company's phone system. Patch this one first.

CVE-2026-76473: "control of a resource through its lifetime", 9.8

One detail worth flagging: the description talks about "improper control of a resource through its lifetime", while the CWE it cites, CWE-74, is the injection family (improper neutralization of special elements passed to a downstream component). The wording and the number tell different stories. NVD data alone cannot settle which is right; Cisco's advisory is authoritative. The vector is identical to CVE-2026-76474.

CVE-2026-76475: XSS, 9.3

XSS rarely scores this high. UI:R means a user has to click or open a crafted page, but S:C with high confidentiality and integrity impact means the script runs somewhere that reaches well beyond the page itself. On a Unified CM admin console, the obvious target is an administrator's session; that is our reading of the vector, not something Cisco has published.

CVE-2026-20043: Snort 3, out-of-bounds write, 9.0

Same approach on the Snort 3 side: an internal review by the Cisco team that maintains the engine, hardening releases, and one CVE grouping out-of-bounds writes. Attack complexity is high (AC:H), but there is no authentication and no interaction. An IDS/IPS engine, by design, parses traffic the attacker chooses: an out-of-bounds memory write in that kind of component should not sit unpatched, even when exploitation is judged difficult.

Affected versions

NVD publishes no version range for these four CVEs, and no fixed version. The only sources are the two Cisco advisories NVD references:

• Voice platform: cisco-sa-voice-hardening-twgbH9e3
• Snort 3: cisco-sa-hardening-snort3-ybgmhTQe

Those advisories list the hardening release to install for each product. Do not infer a target version from some other bulletin.

Detection

The descriptions give no usable indicator: no entry point, no parameter. Detection comes down to exposure and hygiene:

• Inventory: list your Unified CM, IM & Presence, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment servers with their exact version.
• Exposure: make sure their admin and user web interfaces are reachable only from networks that need them.
• Admin accounts: look for logins or configuration changes outside normal maintenance windows.
• Snort 3: find where the engine runs in your environment, standalone or embedded, and which version is live.

Mitigation

1. Read both advisories and install the hardening releases listed for each product. Two unauthenticated 9.8 CVEs justify an early maintenance window on telephony.
2. Restrict network access to the voice platform's admin interfaces: management VLAN, access lists, no direct internet exposure.
3. Warn administrators about CVE-2026-76475: no clicking console links received by email or chat until the fix is in.
4. For Snort 3, update the engine or the product embedding it as the dedicated advisory describes.

This is not the first critical alert on Unified CM this year: see our piece on Unified CM's addition to the KEV catalog in July.

Why continuous monitoring matters for your Cisco estate

CVEs born from internal reviews are easy to miss: no catchy name, no proof of concept, a generic description that names no component. Yet they arrive scored 9.8. The only way not to miss them is to know, at any moment, which versions of which Cisco products you run.

With cveo.tech, register your Unified CM and Unity Connection servers or your Snort sensors with their versions, and get an alert as soon as a critical CVE targets them.