Cisco Expressway Flaw Lets Attackers Execute Commands as Root
Cisco patches CVE-2026-76466 for remote root command execution in clustered Expressway deployments.
85
CVE-2026-76466
Unauthenticated root RCE in Cisco Expressway database service
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Cisco Expressway Series database service uses persistent cookies and does not validate client certificates when TLS Verify Mode is Enabled for clustering. An unauthenticated remote attacker who already has those cookies and network access can connect to the database service and invoke RPC commands. A successful attack runs arbitrary operating-system commands as root. Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) devices are affected.
What to do: Apply Cisco's update for CVE-2026-76466. Cisco has not listed affected or fixed builds.
| Product | Affected |
|---|---|
| Cisco Expressway Series (Expressway-C and Expressway-E) | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
- Weakness
- CWE-798
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
3 storiesCisco Expressway CVE-2026-76466 can run remote commands as root
Clustered Expressway X15.5.3 and earlier are affected; X15.5.20 is the first fix, with no workaround.
73
Cisco patches 34 flaws, including critical Expressway RCE CVE-2026-76466
Fixes include Expressway X15.5.20 and Snort 3.12.4.0; Cisco says none are known to be exploited.
72