Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root.

Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026.

The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled. Successful exploitation could give attackers control over the underlying operating system.

According to Cisco’s security advisory, the weakness sits in the database service and involves persistent cookies. Cisco also found that client certificates are not properly checked when clustering enables TLS Verify Mode. This means the enabled setting does not provide the expected certificate validation.

An attacker who has the required cookies and network access to an affected device could connect to its database service and invoke specific remote procedure call commands. These calls could allow the attacker to run commands with root privileges, the highest level of access on the system.

Cisco Expressway Vulnerability

Although Cisco describes the attacker as unauthenticated, possession of the cookies remains an important requirement. The advisory does not explain how an attacker would obtain them.

Readers should therefore avoid interpreting the finding as proof that an attacker can immediately compromise every reachable Expressway device.

The potential impact resembles other cases covered in Cyber Security News’ reporting on critical Cisco remote code execution flaws, though the affected products and attack methods differ.

Cisco lists Expressway X15.5.3 and earlier as affected, with X15.5.20 identified as the first fixed release. Customers using X14 or earlier must migrate to a fixed release. No workarounds address this vulnerability.

The fix is also included in Cisco’s broader October 2026 Expressway security hardening release. That release addresses additional weaknesses discovered during an internal security review.

Unlike this cluster-specific flaw, the broader hardening advisory covers affected Expressway-C and Expressway-E devices regardless of configuration. Administrators should check installed versions and cluster settings, then plan upgrades using Cisco’s compatibility guidance.

Checking the version alone does not establish exposure because this particular vulnerability also requires a clustered deployment. Broader coverage is available through Cyber Security News’ Cisco security updates.

Cisco credited Stefan Aleksic of Jane Street with reporting the vulnerability. At publication, its Product Security Incident Response Team said it was unaware of public announcements or malicious use. That statement does not reduce the need to patch affected clusters, given the potential for remote commands to run as root.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.