--- id: "CVE-2026-76466" kind: "vulnerability" aliases: ["CVE-2026-76466"] title: "Cisco Expressway: unauthenticated remote root command execution via database service" severity: "critical" cvss: 9.8 epss: 0.00381 exploited: false status: "open" category: "infrastructure" products: [{"name": "Cisco Expressway Series (Expressway-C/E)", "fixed": ["X15.5.20"], "affected": "X14 and earlier; X15.5.3 and earlier (clustered only)", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cisco-expressway", "clustering", "infrastructure", "rce", "self-hosted", "video-conferencing"] not_affected_if: ["non-clustered"] published_at: "2026-10-21T17:19:06+00:00" first_seen_at: "2026-10-23T21:57:29+00:00" updated_at: "2026-10-24T13:15:54+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76466", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:29:37+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:50:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76466", "first_seen_at": "2026-10-24T13:15:54+00:00"}] --- # Cisco Expressway: unauthenticated remote root command execution via database service Cisco Expressway-C and Expressway-E devices in a cluster have a flaw in the database service. Persistent cookies act like hard-coded credentials, and client certificates are not validated when clustering TLS Verify Mode is Enabled. A remote attacker with network access who holds the cookies can call RPC commands and run OS commands as root. No login is needed, but the cookies are required. CVSS 9.8. Cisco knows of no exploitation and offers no workaround. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Cisco Expressway Series (Expressway-C/E) affected X14 and earlier; X15.5.3 and earlier (clustered only) fixed X15.5.20 ## How to check The advisory gives no check command. You are exposed if an Expressway-C or Expressway-E (virtual or appliance) is in a cluster and runs X15.5.3 or earlier, or any X14 or earlier release. Look up the running version in the Expressway web UI (Status > Overview) and confirm clustering under System > Clustering. Standalone nodes are not listed as vulnerable. Restrict network access to the cluster database service to cluster peers while you plan the upgrade. ## Fix Upgrade clustered X15.5.3 and earlier to X15.5.20 or later. For X14 and earlier, Cisco names no fixed release and says to migrate to a fixed release, so move to X15.5.20 or later. No workaround exists. ## Timeline - 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76466 - 2026-10-23T22:29:37+00:00 analyst — Read Cisco PSIRT advisory cisco-sa-vcs-static-cred-hr7EWZ8t (Oct 21 2026): affects clustered Expressway-C/E; fixed X15.5.20; no workaround; no known exploitation. TLS Verify Mode is a contributing weakness, not the sole trigger: persistent (hard-coded-like) cookies plus unvalidated client certs. No community posts searched. - 2026-10-23T22:50:33+00:00 analyst — Re-checked against the Cisco advisory I already read (no new sources). X14 and earlier: table says only 'Migrate to a fixed release', no named version; X15.5.3 and earlier: X15.5.20. Advisory gives no check command. 'Unauthenticated' means no login is needed, but the attacker must hold the persistent cookies (CWE-798, effectively a shared secret), so the wording is not contradictory but understates the precondition. Cisco: no known exploitation, no workaround. - 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76466 ## Documents - [advisory] Cisco Expressway Series Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t - [describes] Cisco Patches 34 Vulnerabilities Across Multiple Products - SecurityWeek https://www.securityweek.com/cisco-patches-34-vulnerabilities-across-multiple-products/ ## From the sources A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_