Cisco patches Expressway root command flaw CVE-2026-76466
October 23: Cyber Security News named reporter Stefan Aleksic of Jane Street, said X14 must migrate, and cited PSIRT on no public announcements or malicious use.
Cisco fixed critical clustered Expressway flaw CVE-2026-76466; no exploitation is known.
Cisco’s October 21, 2026 Expressway advisories include a critical database-service flaw, CVE-2026-76466, also addressed in an October 2026 hardening release from an internal review. An unauthenticated remote attacker with network access and persistent cookies can invoke RPC commands and run operating-system commands as root when clustering has TLS Verify Mode set to Enabled and client certificates are insufficiently validated. GBHackers and Cyber Security News say clustered Expressway Core and Edge through X15.5.3 are affected, including virtual and hardware deployments; X15.5.20 is the first fix and there is no workaround. The Canadian Centre for Cyber Security lists Expressway before X15.5.20. Cisco’s PSIRT said it knew of no public announcements or malicious use. Stefan Aleksic of Jane Street reported the flaw.
- CVE-2026-76466 has a CVSS score of 9.8.
- Affected releases are clustered Expressway Core and Edge X15.5.3 and earlier.
- X15.5.20 is the first fixed release; X14 and earlier must migrate.
- Exploitation needs network access and the persistent cookies.
- Cisco says it is not aware of malicious use.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Cisco publishes Expressway advisory and hardening release. · Cyber Security News
- Oct 21, 2026Canadian Centre issues AV26-1073 on Cisco updates. · Canadian Centre for Cyber Security
- Oct 22, 2026GBHackers reports CVE-2026-76466 fixed in X15.5.20. · GBHackers
- Oct 23, 2026Report names Jane Street researcher and no workaround. · Cyber Security News
What each outlet adds
beyond the shared facts- Cisco Security AdvisoriesCookie-based database RPC path and TLS certificate gap.
- GBHackersNames CVE-2026-76466, CVSS 9.8, and X15.5.3 cutoff.
- Cyber Security NewsJane Street reporter, X14 migration, no workaround.
- Canadian Centre for Cyber SecurityLists Expressway updates before X15.5.20 under AV26-1073.
- CVEs
- CVE-2026-76466
Coverage
oldest first · one row per article · UTC- · 4d ago
Cisco Security AdvisoriesFirst report
Cisco Expressway Series October 2026 hardening covers internal flaws
Cisco grouped the issues by weakness class and assigned one CVE to each group, but IDs are not in the excerpt.
- · 4d ago
Cisco Expressway flaw allows unauthenticated remote root commands
An attacker who has the persistent cookies can reach the database service and run RPC commands as root.
- · 4d ago
Cisco Expressway flaw lets remote attackers read sensitive data
A crafted HTTP request during Mobile and Remote Access provisioning can bypass authorization checks on Expressway-C and Expressway-E.
- · 4d ago
Canadian Centre for Cyber Security
Cyber Centre flags Cisco flaws in several products (AV26-1073)
Named fixes include Expressway X15.5.20, Snort 3.12.4.0, Cyber Vision 5.6.0, and Secure Client 5.1.20.333.
- · 3d ago
GBHackers
Cisco Expressway Flaw Lets Attackers Execute Commands as Root
Cisco patches CVE-2026-76466 for remote root command execution in clustered Expressway deployments.
- · 2d ago
Cyber Security News
Cisco Expressway CVE-2026-76466 can run remote commands as root
Clustered Expressway X15.5.3 and earlier are affected; X15.5.20 is the first fix, with no workaround.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76466 | Unauthenticated root RCE in Cisco Expressway database service | 9.8 | — |