{"id":"CVE-2026-76466","kind":"vulnerability","aliases":["CVE-2026-76466"],"related":[],"title":"Cisco Expressway: unauthenticated remote root command execution via database service","description":"A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.\r\n\r\nThis vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.","summary":"Cisco Expressway-C and Expressway-E devices in a cluster have a flaw in the database service. Persistent cookies act like hard-coded credentials, and client certificates are not validated when clustering TLS Verify Mode is Enabled. A remote attacker with network access who holds the cookies can call RPC commands and run OS commands as root. No login is needed, but the cookies are required. CVSS 9.8. Cisco knows of no exploitation and offers no workaround.","severity":"critical","cvss":9.8,"epss":0.00381,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Expressway Series (Expressway-C/E)","fixed":["X15.5.20"],"affected":"X14 and earlier; X15.5.3 and earlier (clustered only)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco-expressway","clustering","infrastructure","rce","self-hosted","video-conferencing"],"not_affected_if":["non-clustered"],"how_to_check":"The advisory gives no check command. You are exposed if an Expressway-C or Expressway-E (virtual or appliance) is in a cluster and runs X15.5.3 or earlier, or any X14 or earlier release. Look up the running version in the Expressway web UI (Status > Overview) and confirm clustering under System > Clustering. Standalone nodes are not listed as vulnerable. Restrict network access to the cluster database service to cluster peers while you plan the upgrade.","fix":"Upgrade clustered X15.5.3 and earlier to X15.5.20 or later. For X14 and earlier, Cisco names no fixed release and says to migrate to a fixed release, so move to X15.5.20 or later. No workaround exists.","status":"open","published_at":"2026-10-21T17:19:06+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:14+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:33:14Z","model":"claude-haiku-5-5","output":{"fix":"Move to X15.5.20, the fixed release the sources list for clustered X15.5.3 and earlier. The sources do not name a fixed release for X14 and earlier; check the Cisco advisory.","reach":"network","title":"Cisco Expressway: unauthenticated remote root command execution via database service","impact":"high","summary":"A flaw in the database service of Cisco Expressway Core and Edge devices lets a remote attacker with network access run arbitrary OS commands. The attacker needs persistent cookies, and client certificates are not validated when clustering TLS Verify Mode is enabled, so the attacker gets root on the underlying device.","category":"infrastructure","who_cares":["cisco-expressway","self-hosted","video-conferencing","clustering"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary OS commands as root on the appliance","analyst_note":"Find the fixed release for X14 and earlier and a check command in the Cisco advisory for CVE-2026-76466; confirm whether the cookie requirement conflicts with the 'unauthenticated' wording in NVD.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-clustered"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001007,"input_tokens":3202,"output_tokens":1374,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed release for X14 and earlier and a check command in the Cisco advisory for CVE-2026-76466; confirm whether the cookie requirement conflicts with the 'unauthenticated' wording in NVD.","search":"'-2026':12A,15A '-76466':13A,16A '/e':23A '9.8':106B 'access':81B,135C 'act':57B 'addit':159C 'affect':231C 'allow':128C,215C 'arbitrari':143C,220C 'attack':78B,132C,187C,217C 'c':22A,39B,244C 'call':87B,208C 'certif':65B,166C,182C 'cisco':1A,17A,25B,36B,107B,124C,138C,234C,239C,247C 'cisco-expressway':24B 'client':64B,165C,181C 'cluster':27B,47B,70B,177C 'code':61B 'command':6A,89B,93B,146C,210C,221C 'conferenc':35B 'connect':198C 'cooki':56B,85B,102B,158C,192C 'core':241C 'could':127C,193C,214C 'credenti':62B 'cve':11A,14A 'cvss':105B 'databas':9A,53B,120C,201C 'devic':44B,140C,232C,245C,253C 'due':152C 'e':43B,252C 'edg':249C 'enabl':75B,175C 'execut':7A,142C,219C 'exploit':111B,194C,213C 'expressway':2A,18A,21A,26B,38B,42B,125C,139C,235C,240C,243C,248C,251C 'expressway-':41B,250C 'expressway-c':20A,37B,242C 'featur':122C 'flaw':50B 'hard':60B 'hard-cod':59B 'hold':83B 'host':32B 'infrastructur':28B 'insuffici':162C 'invok':204C 'know':108B 'like':58B 'login':97B 'mean':179C 'mode':73B,171C 'need':99B 'network':80B,134C 'note':233C 'offer':113B 'oper':144C,227C 'os':92B 'persist':55B,157C 'possess':189C 'procedur':207C 'rce':29B 'refer':237C 'remot':4A,77B,131C,206C 'requir':104B 'root':5A,95B,148C,223C 'rpc':88B,209C 'run':91B 'self':31B 'self-host':30B 'seri':126C,236C 'series':19A 'servic':10A,54B,121C,202C 'set':173C 'specif':205C 'success':212C 'system':145C,228C 'tls':71B,169C 'unauthent':3A,130C 'under':226C 'use':155C 'valid':68B,163C,185C 'verifi':72B,170C 'via':8A 'video':34B 'video-conferenc':33B 'vulner':117C,150C,196C 'workaround':115B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76466","severity":null,"published_at":"2026-10-21T17:19:06+00:00","modified_at":"2026-10-22T23:19:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76466:235","url":null,"severity":null,"published_at":"2026-10-23T22:29:37+00:00","modified_at":"2026-10-23T22:29:37+00:00","first_seen_at":"2026-10-23T22:29:37+00:00","fetched_at":"2026-10-23T22:29:37+00:00","note":"Read Cisco PSIRT advisory cisco-sa-vcs-static-cred-hr7EWZ8t (Oct 21 2026): affects clustered Expressway-C/E; fixed X15.5.20; no workaround; no known exploitation. TLS Verify Mode is a contributing weakness, not the sole trigger: persistent (hard-coded-like) cookies plus unvalidated client certs. No community posts searched."},{"source":"analyst","external_id":"CVE-2026-76466:311","url":null,"severity":null,"published_at":"2026-10-23T22:50:33+00:00","modified_at":"2026-10-23T22:50:33+00:00","first_seen_at":"2026-10-23T22:50:33+00:00","fetched_at":"2026-10-23T22:50:33+00:00","note":"Re-checked against the Cisco advisory I already read (no new sources). X14 and earlier: table says only 'Migrate to a fixed release', no named version; X15.5.3 and earlier: X15.5.20. Advisory gives no check command. 'Unauthenticated' means no login is needed, but the attacker must hold the persistent cookies (CWE-798, effectively a shared secret), so the wording is not contradictory but understates the precondition. Cisco: no known exploitation, no workaround."},{"source":"epss","external_id":"CVE-2026-76466","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76466","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1477,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t","title":"Cisco Expressway Series Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1475,"url":"https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/","title":"Cisco Patches 34 Vulnerabilities Across Multiple Products - SecurityWeek","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}