Critical RCE flaw in Cisco Expressway clustering lets attacker run root commands
Cisco disclosed a critical vulnerability (CVE-2026-76466, CVSS 9.8) in the database service of Expressway-C and Expressway-E devices configured in a cluster. An unauthenticated remote attacker who obtains persistent cookies and exploits insufficient client certificate validation during clustering (when TLS Verify Mode is Enabled) could invoke RPC commands and execute arbitrary OS commands as root. No workarounds exist; Cisco has released fixed software.
SECURITY · NETWORK · COLLABORATION · SECURITY ADVISORY · VULNERABILITY
PUBLISHED OCT 23, 2026 19:51 UTC
WHAT CHANGED
Cisco published a security advisory describing a flaw caused by use of persistent cookies and insufficient validation of client certificates when TLS Verify Mode is set to Enabled for clustering on Expressway-C and Expressway-E (virtual and appliance) devices configured in a cluster. An attacker possessing the cookies can connect to the database service and invoke specific RPC commands to execute arbitrary root-level OS commands. Releases X14 and earlier require migration to a fixed release; X15.5.3 and earlier are fixed in X15.5.20. The fix is also part of the broader October 2026 Expressway Security Hardening Release.
WHY IT MATTERS
A successful exploit grants full root access to the underlying OS of an Expressway device with no authentication required and no available workaround, posing a severe risk to voice/video collaboration infrastructure. Administrators running clustered Expressway deployments must prioritize patching since exploitation could lead to complete device compromise, though Cisco PSIRT states no public exploitation has been observed yet.
WHO IS AFFECTED
- ROLES
- network administratorssecurity administrators
- PRODUCTS
- Cisco Expressway-CCisco Expressway-E
- FEATURES
- database serviceclustering
- CONFIGURATIONS
- Devices configured in a clusterTLS Verify Mode set to Enabled for clustering
- ENVIRONMENTS
- virtualappliance
- EXCLUSIONS
- Expressway devices not configured in a cluster
WHAT TO DO
- 01CRITICALAUTOMATABLE
Upgrade Cisco Expressway-C and Expressway-E devices running X15.5.3 or earlier to the fixed release X15.5.20.
DOCUMENTATION - 02CRITICAL
Migrate devices running Expressway Series X14 and earlier to a fixed release, since no direct fix exists for that version line.
DOCUMENTATION - 03HIGH
Review Expressway cluster configurations to confirm TLS Verify Mode and client certificate validation settings pending patch deployment.
DOCUMENTATION - 04MEDIUM
Contact Cisco TAC for upgrade entitlement if a service contract is not held, providing the product serial number and advisory URL.
DOCUMENTATION
TIMELINE
- ANNOUNCED
- OCT 21, 2026
SOURCES
- PRIMARY SOURCECISCO
Cisco Expressway Series Remote Code Execution Vulnerability
PUBLISHED OCT 21, 2026VIEW SOURCE
VERIFICATION
ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.