Cisco Expressway: unauthenticated remote root command execution via database service

1. NVD2026-10-23 21:57 UTC · published 2026-10-21 17:19 UTC · CVE-2026-76466
2. InfraStack analyst2026-10-23 22:29 UTC · published 2026-10-23 22:29 UTC
   “Read Cisco PSIRT advisory cisco-sa-vcs-static-cred-hr7EWZ8t (Oct 21 2026): affects clustered Expressway-C/E; fixed X15.5.20; no workaround; no known exploitation. TLS Verify Mode is a contributing weakness, not the sole trigger: persistent (hard-coded-like) cookies plus unvalidated client certs. No community posts searched.”
3. InfraStack analyst2026-10-23 22:50 UTC · published 2026-10-23 22:50 UTC
   “Re-checked against the Cisco advisory I already read (no new sources). X14 and earlier: table says only 'Migrate to a fixed release', no named version; X15.5.3 and earlier: X15.5.20. Advisory gives no check command. 'Unauthenticated' means no login is needed, but the attacker must hold the persistent cookies (CWE-798, effectively a shared secret), so the wording is not contradictory but understates the precondition. Cisco: no known exploitation, no workaround.”
4. EPSS2026-10-24 13:15 UTC · CVE-2026-76466

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-76466 · 10-23 21:57
• EPSS: CVE-2026-76466 · 10-24 13:15
• Cisco Expressway Series Remote Code Execution VulnerabilityAdvisory · InfraStack analyst
• Cisco Patches 34 Vulnerabilities Across Multiple Products - SecurityWeekDescribes it · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-76466")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.