Cisco patches critical voice system vulnerabilities: what businesses need to know
Cisco disclosed three critical security advisories on October 21, 2026 affecting business phone systems and collaboration infrastructure. No exploitation detected yet, but businesses running Expressway and Unified Communications Manager should act quickly.
October 26, 2026 · 6 min read
On October 21, 2026, Cisco disclosed three separate security advisories affecting the phone systems and collaboration infrastructure running millions of business phone lines. The most severe carries a CVSS score of 9.8 out of 10. Cisco's Product Security Incident Response Team states it is not aware of public announcements or malicious use of any of the issues, and none appear in CISA's Known Exploited Vulnerabilities catalog as of October 23, 2026.
But given the severity and that some affected devices often sit at the network edge, businesses should act quickly.
The three vulnerabilities Cisco patched
Cisco released patches for 34 vulnerabilities across multiple products on October 21, 2026. Three advisories directly affect business voice infrastructure:
CVE-2026-76466: Critical Expressway remote code execution. This vulnerability allows unauthenticated remote attackers to execute operating system commands as root on Cisco Expressway Series devices. CVSS score: 9.8 critical. It affects clustered Expressway-C and Expressway-E deployments only. Standalone deployments are not affected. Expressway devices provide remote worker and partner access to internal calling and video, often sitting at the network edge or in the DMZ.
Cisco Unified Communications Products Security Hardening Release: Eight grouped CVEs. This advisory addresses CVE-2026-76473 through CVE-2026-76479 and CVE-2026-76481, with two rated CVSS 9.8 critical. Affected products: Unified Communications Manager, Emergency Responder, Prime Collaboration Deployment, IM & Presence, and Unity Connection.
CVE-2026-76487: Medium-severity access control bypass. This vulnerability is caused by improper input validation of HTTP requests in Unified Communications Manager and Unified CM SME. CVSS score: 5.3 medium.
What each vulnerability means for your phone system
CVE-2026-76466 requires network access to the Expressway cluster and possession of persistent cookies, but no authentication. The attacker can then execute commands as root. Fixed in version X15.5.20. Deployments running X14 or earlier have no patch available and must migrate to X15.5.20.
If your organization uses Expressway for remote access to Webex or third-party video endpoints, and you run a clustered deployment, this affects you. Standalone Expressway deployments are not vulnerable.
The eight hardening CVEs affect Unified Communications Manager and related products. Version 15SU5 fixes all of them. Organizations running release 14 must migrate to 15SU5. This is a significant version jump for many deployments and requires planning.
CVE-2026-76487 is less severe but still requires patching. The same 15SU5 release fixes it.
What businesses should do now
If you manage your own Cisco voice infrastructure:
- Identify affected systems. Check if you run Expressway-C, Expressway-E, or Unified Communications Manager. Log into each device and note the version.
- Compare your versions against Cisco's advisories. Expressway versions below X15.5.20 are vulnerable if clustered. Unified CM versions below 15SU5 are vulnerable.
- Plan your upgrades. Moving from release 14 to 15SU5 or from Expressway X14 to X15.5.20 is not a quick patch. It requires testing, maintenance windows, and coordination with your Cisco partner or internal IT team.
- For organizations unable to patch immediately: Segment network access to affected systems. Monitor logs for unusual activity. Restrict which networks can reach Expressway devices. Consider temporarily disabling remote access if feasible.
- Schedule maintenance windows. Work with your Cisco partner or IT team to schedule downtime for upgrades. Voice systems require careful cutover planning to avoid disrupting active calls.
If a managed service provider or telecom partner handles your Cisco infrastructure, contact them and ask what their patching timeline is.
What this means when choosing a phone system
Security is not a one-time decision. It requires ongoing attention.
On-premises and hybrid Cisco deployments need active lifecycle management. When Cisco releases a critical patch, someone has to plan the upgrade, test it, schedule downtime, and execute the cutover. For many businesses, that someone is an overworked IT generalist managing dozens of other systems.
Hosted and cloud phone systems like RingCentral, Dialpad, 8x8, Zoom Phone, and Microsoft Teams Phone handle infrastructure patching themselves. The provider applies security updates to the backend systems without customer involvement. Your team still manages user accounts, phone settings, and call flows, but the operating system, firmware, and platform security are the provider's responsibility.
That does not mean cloud systems have no vulnerabilities. Every platform has them. The difference is who handles the patching and how quickly it happens.
For businesses evaluating phone systems or frustrated with the operational burden of maintaining on-premises infrastructure, comparing UCaaS platforms is worth the time. Empire helps businesses assess current environments, compare cloud and hybrid options, and plan migrations. Learn more at empiretelecomnj.com/ucaas-professional-services.
Frequently asked questions
How do I know if my phone system is affected?
Log into your Cisco devices and check the version. Expressway devices show the version on the landing page after login. Unified Communications Manager shows it under System > Cisco Unified CM Administration. If you run Expressway X14 or earlier in a clustered deployment, or Unified CM release 14 or earlier, you are affected.
What happens if I can't patch right away?
Cisco has not seen active exploitation yet, but that can change. Segment network access to the affected systems. Restrict which IP ranges can reach Expressway. Monitor authentication logs and system logs for unusual activity. Work with your IT team or Cisco partner to plan the upgrade as soon as feasible.
Should I move to a cloud phone system to avoid patching?
Cloud systems shift the patching responsibility to the provider, but they are not the right fit for every organization. Some businesses have regulatory, latency, or integration requirements that favor on-premises or hybrid deployments. The question is whether your team has the time and expertise to manage ongoing infrastructure updates. If the answer is no, cloud deserves a close look.
What's the difference between Expressway and Unified Communications Manager?
Unified Communications Manager is the call control platform that handles phone registrations, call routing, voicemail, and feature logic. Expressway provides secure remote access to Unified CM and video endpoints for workers outside the office and for federation with other organizations. Many businesses run both.
How often does Cisco release security updates?
Cisco publishes security advisories as issues are discovered and fixed. Critical vulnerabilities are disclosed as soon as patches are ready. Organizations running Cisco infrastructure should monitor the Cisco Security Advisories page and subscribe to alerts.
What to do next
If you run Cisco Expressway or Unified Communications Manager, check the October 21, 2026 advisories and plan your patching timeline. The vulnerabilities are serious, and the fixes require significant version upgrades for many deployments.
If you are evaluating phone systems and want to compare how cloud platforms and on-premises systems handle security updates, or if you need help assessing your current Cisco environment and planning a migration, Empire can help. Visit empiretelecomnj.com/ucaas or call (732) 363-9898.
