CVE-2026-76466
Attackers can execute commands as root on Cisco Expressway devices.
A vulnerability in the database service of Cisco Expressway Series devices allows an unauthenticated, remote attacker to execute arbitrary operating system commands as root. This is due to the use of persistent cookies and insufficient validation of client certificates. Affected devices include Cisco Expressway Core and Edge systems. No fixed versions have been released, and the vulnerability is not yet on CISA's exploited list.
Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · Updated 28 Oct · From the public records
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- As no fix is available, follow Cisco's official guidance for workarounds, such as restricting network access to the affected devices.
- Monitor Cisco's security advisories for the release of a software update.
- If possible, disable or limit the use of persistent cookies on the database service.
What happened
- 21 OctCisco disclosed and published an advisory about the vulnerability.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-76466 | Cisco Expressway Series Remote Code Execution Vulnerability | critical 9.8 | No | 0.4% |
Our reporting
We have not reported on it. It is here because the sources below did.