Cisco has issued security updates for a critical vulnerability in Cisco Expressway that could allow remote attackers to execute operating system commands as root.
Tracked as CVE-2026-76466 with a CVSS score of 9.8, the flaw affects Expressway devices that are configured in a cluster. Cisco published its advisory on October 21, 2026.
The vulnerability impacts both Cisco Expressway Core (Expressway‑C) and Cisco Expressway Edge (Expressway‑E). Virtual deployments and hardware appliances are affected when they run vulnerable software with clustering enabled. Successful exploitation can give an attacker control over the underlying operating system.
According to Cisco’s advisory, the weakness lies in the database service and involves persistent cookies. Cisco also found that client certificates are not properly validated when clustering enables TLS Verify Mode, so that setting does not provide the expected certificate verification.
An attacker who possesses the required cookies and has network access to an affected device could connect to its database service and invoke specific remote procedure call (RPC) commands. Those calls could allow the attacker to run commands with root privileges.
Cisco Expressway vulnerability
Although Cisco characterizes the attacker as unauthenticated, possession of the cookies is a necessary prerequisite. The advisory does not specify how an attacker would obtain those cookies, so readers should not assume every reachable Expressway device is immediately exploitable.
The potential impact is similar in severity to other critical Cisco remote code execution flaws reported by Cyber Security News, though the affected products and exploitation methods differ.
Cisco lists Expressway X15.5.3 and earlier as affected, and identifies X15.5.20 as the first fixed release. Customers running X14 or earlier must migrate to a fixed release. Cisco reports that there are no workarounds for this vulnerability.
The fix is included in Cisco’s broader October 2026 Expressway security hardening release, which addresses additional weaknesses discovered during an internal security review. Unlike this cluster‑specific flaw, the broader hardening advisory covers affected Expressway‑C and Expressway‑E devices regardless of configuration. Administrators should verify installed versions and cluster settings and plan upgrades using Cisco’s compatibility guidance.
Because this vulnerability requires a clustered deployment in addition to a vulnerable version, checking the software version alone does not confirm exposure. Cyber Security News provides broader coverage of Cisco security updates.
Cisco credited Stefan Aleksic of Jane Street with reporting the issue. At publication, Cisco’s Product Security Incident Response Team (PSIRT) stated it was unaware of any public announcements or malicious exploitation. Nonetheless, administrators should patch affected clusters promptly given the risk of remote commands executing as root.
Update defenses against new malware as soon as it appears. Integrate threat intelligence feeds with data from 16K SOCs.
