Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks

What happened?

Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root. Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026. The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled.

Key details

• Flaw resides in database service involving persistent cookies and improper client certificate validation.
• Attacker needs required cookies and network access to invoke remote procedure calls for root commands.
• Both Expressway-C and Expressway-E virtual and hardware deployments are affected when clustering is enabled.
• Cisco credits Stefan Aleksic of Jane Street and reports no public announcements or malicious use at publication.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.