Cisco Expressway CVE-2026-76466 can run remote commands as root
Original title: Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks
Clustered Expressway X15.5.3 and earlier are affected; X15.5.20 is the first fix, with no workaround.
Cisco released updates for a critical Expressway database-service flaw that can let a remote attacker with required cookies run operating-system commands as root. CVE-2026-76466, CVSS 9.8, affects clustered Expressway Core and Edge, including virtual and hardware deployments, on X15.5.3 and earlier. Clustering’s TLS Verify Mode does not properly check client certificates. Cisco’s PSIRT said it knew of no public announcements or malicious use.
Unconfirmed: The advisory does not explain how an attacker would obtain the required cookies.
- Cisco published the advisory on October 21, 2026.
- Customers on X14 or earlier must migrate to a fixed release.
- The fix is also in the October 2026 Expressway hardening release.
- Stefan Aleksic of Jane Street reported the vulnerability.
Impact: remote operating-system commands as root
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Expressway Core and Edge | X15.5.3 and earlier | X15.5.20 |
- 1.Upgrade clustered Expressway devices to X15.5.20 or another fixed release.
- 2.Check cluster settings, because this flaw requires clustering to be enabled.
- CVEs
- CVE-2026-76466
- Vendors
- Cisco
- Organizations
- Jane Street
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76466 | Unauthenticated root RCE in Cisco Expressway database service | 9.8 | — |
From the original article
2 min read at cybersecuritynews.com
Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9. 8 and affects vulnerable Expressway devices configured in a cluster.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.