Cisco Expressway Series: unauthenticated root RCE via static credentials plus hardening-release batch (CVE-2026-76466)
Severity: critical · Patch status: patched · Since 2026-10-21 · CVE-2026-76435, CVE-2026-76466, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497
Cisco published advisories on 2026-10-21 for Cisco Expressway Series (Expressway-C/E). CVE-2026-76466 (CVSS 9.8, CWE-798) is a critical unauthenticated remote RCE: use of persistent cookies plus insufficient client-certificate validation in clustering lets an attacker with network access connect to the database service and invoke RPC commands to execute arbitrary OS commands as root. It affects devices running X15.5.3 or earlier when configured in a cluster; no workarounds exist. A companion hardening advisory (cisco-sa-exwy-hardening-FhcqBVcs, max CVSS 8.6) fixes eight internally discovered issues (CVE-2026-76490 through -76497) covering out-of-bounds write, reachable assertions, null derefs, code injection, link following, insecure temp files and permission flaws, found partly using frontier AI models. Neither is known to be exploited. Fixed in X15.5.20; X14 and earlier must migrate.
What to do
- Upgrade clustered Expressway-C/E devices to X15.5.20 or later immediately, prioritising internet-facing Expressway-E
- Migrate devices on X14 or earlier to a fixed release
- Restrict network access to the database service and clustering ports (firewall/ACL) as interim mitigation until patched
- Audit cluster configurations and TLS Verify Mode settings; review logs for suspicious RPC connections to the database service
- Apply the October 2026 hardening release fixes to all Expressway deployments regardless of clustering configuration
Fixed versions
Sources
All live incidents on Threat Watch
