Cisco Expressway Series: Remote code execution via persistent cookies
Summary
The database service of Cisco Expressway Series (Expressway-C and Expressway-E) can be abused by an unauthenticated attacker with network access to run arbitrary operating system commands as root. The cause is persistent cookies combined with insufficient validation of client certificates when TLS Verify Mode is set to Enabled for clustering. An attacker needs possession of the cookies and must invoke specific RPC commands on the database service. Only devices configured in a cluster are affected.
Affected
- Cisco Expressway-C and Expressway-E (virtual and appliance) running X14 and earlier
- X15.5.3 and earlier, only if the device is configured in a cluster
Fixed in
- X15.5.20 (for X15.5.3 and earlier)
- X14 and earlier: migrate to a fixed release
- Cisco also published the Cisco Expressway Series Security Hardening Release: October 2026, which includes this fix
Workaround
- None. Cisco states that no workarounds are available.
- Interim measure: review logs for database service connections from hosts that are not cluster peers.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Conflicting reports on CISA KEV listing; verify in the CISA KEV catalog.
Our recommendation
- Check every Expressway-C and Expressway-E unit for software release and clustering status.
- Upgrade clustered units to X15.5.20 or the October 2026 hardening release; migrate X14 and earlier to a fixed release.
- Prioritise internet-facing Expressway-E units.
- Restrict access to the database service at network level after verifying the port and interface on your devices.
- Monitor logs for unexpected database service connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-vcs-static-cred-hr7EWZ8t sec.cloudapps.cisco.com
- Analysis of CVE-2026-76466 (dev.to) dev.to
- Cryptika: Critical Cisco Expressway vulnerability www.cryptika.com
- ThreatFrontier: CVE-2026-76466 threatfrontier.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:06.
Original description (NVD)
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.