Cisco Expressway: critical flaw (CVE-2026-76466, CVSS 9.8) lets an unauthenticated remote attacker run commands as root through the database service on clustered Expressway-C and Expressway-E; fixed in X15.5.20, no workarounds
Cisco published a critical advisory (cisco-sa-vcs-static-cred-hr7EWZ8t) on 21 October 2026 at 16:00 GMT (22 Oct 00:00 Perth) for CVE-2026-76466 in the database service feature of Cisco Expressway Series. According to Cisco, an unauthenticated, remote attacker with network access to an Expressway device could run arbitrary operating system commands as root. Cisco says the flaw is due to the use of persistent cookies, and that client certificates are not validated when TLS Verify Mode is set to Enabled for clustering; an attacker who has the cookies could connect to the database service and invoke specific remote procedure call (RPC) commands. Cisco rates it CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-798 (use of hard-coded credentials), bug CSCww27732. It affects Expressway-C and Expressway-E, virtual and appliance, only when the devices are configured in a cluster. Cisco lists X15.5.20 as the first fixed release for X15.5.3 and earlier, says X14 and earlier must migrate to a fixed release, and says there are no workarounds; the fix is also part of the 'Cisco Expressway Series Security Hardening Release: October 2026'. Cisco's PSIRT says it is not aware of any public announcements or malicious use. Cisco credits Stefan Aleksic of Jane Street. The advisory is part of Cisco's 21 October 2026 bundled publication. Source: Cisco security advisory cisco-sa-vcs-static-cred-hr7EWZ8t (21 Oct 2026).
- Product
- Cisco Expressway Series (Expressway-C and Expressway-E, virtual and appliance) in a cluster
- Versions
- Affected (Cisco): clustered Expressway-C/-E on X15.5.3 and earlier (fixed in X15.5.20); X14 and earlier: migrate to a fixed release
- CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploited in Australia?
- unknown
- Patch to
- Upgrade clustered Expressway-C and Expressway-E to X15.5.20 (Cisco lists no workarounds); migrate X14 and earlier to a fixed release. Until patched, restrict network access to Expressway cluster and management interfaces to the cluster peers and admin hosts, and review the other advisories in Cisco's October 2026 Expressway hardening release.
Primary: Cisco — Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t, 21 Oct 2026) · CVE: CVE-2026-76466