In a significant security update, Cisco has addressed a critical vulnerability in its Expressway devices that could allow attackers to execute commands on the operating system with root access. The flaw, identified as CVE-2026-76466, holds a high CVSS score of 9.8, indicating its severe potential impact.
Details of the Vulnerability
The vulnerability affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices, both in virtual and hardware forms, particularly when they are configured for clustering operations. Cisco’s advisory, released on October 21, 2026, highlights the risk of attackers gaining control over the underlying system.
This issue is rooted in the database service, where persistent cookies play a crucial role. Moreover, the advisory notes a flaw in the TLS Verify Mode, where client certificates are not adequately verified, compromising the expected security.
Exploitation and Impact
An attacker with the necessary cookies and network access can connect to the vulnerable device’s database service, executing remote procedure calls to perform commands with root privileges. While the attacker is described as unauthenticated, obtaining the cookies is a critical step, which the advisory does not detail.
The implications of this vulnerability are severe, echoing past reports of critical remote code execution vulnerabilities in Cisco products. Customers using Expressway versions up to X15.5.3 are affected, with X15.5.20 marking the first secure release. Those on older versions must upgrade to mitigate the risk.
Security Measures and Updates
The fix for this vulnerability is part of a broader security hardening update released by Cisco in October 2026. This release also addresses other potential weaknesses found during internal reviews, affecting Expressway-C and Expressway-E devices regardless of clustering.
Administrators are urged to assess their current software versions and cluster configurations, planning upgrades in line with Cisco’s guidance. It is essential to note that simply checking the version is insufficient, as clustering is a prerequisite for exploitation.
Stefan Aleksic from Jane Street is credited with reporting this vulnerability. Although there have been no public exploitations reported, Cisco’s Product Security Incident Response Team emphasizes the necessity for immediate updates to prevent potential misuse.
As part of ongoing cybersecurity practices, organizations should enhance defenses against emerging threats by integrating threat intelligence feeds and staying current with security advisories.
