Cisco Patches Critical Expressway Series Vulnerabilities Including Root RCE Flaw

TL;DR

Cisco released three security advisories on October 21, 2026, addressing ten distinct Cisco Expressway vulnerabilities across Core and Edge appliances. The most severe flaw, CVE-2026-76466, carries a critical 9.8 CVSS score and allows unauthenticated remote attackers to execute root commands. Network administrators must upgrade their Expressway deployments immediately because no workarounds exist.

Notable CVEs

Why It Matters

Cisco Expressway Series gateways include Expressway Core (Expressway-C) and Expressway Edge (Expressway-E). These gateways enable secure firewall traversal for enterprise voice and video collaboration. While the exact affected installation counts are not specified in the advisories, thousands of organizations rely on these perimeter appliances for Mobile and Remote Access (MRA).

Exposing perimeter gateways to these Cisco Expressway vulnerabilities puts internal collaboration networks at severe risk of complete takeover. Across all three publications, the vendor notes the following: “The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.” Currently, no public proof-of-concept exists. Additionally, no active exploitation in the wild has been confirmed.

How the Attack Works

The flaws stem from improper authentication, missing authorization checks, and multiple code-level weaknesses across the operating system and web services.

Critical Root Remote Code Execution

First, researcher Stefan Aleksic of Jane Street reported CVE-2026-76466 (CVSS 9.8). According to the security advisory, “This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated.” Consequently, an attacker possessing the cookies can connect to the database service and invoke specific RPC commands. As a result, they can execute arbitrary operating system commands as root.

Information Disclosure and AI-Assisted Hardening Fixes

Next, Cisco patched CVE-2026-76435 (CVSS 5.3), a flaw discovered during a TAC support case. As detailed in the advisory, “This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning.” Unauthenticated attackers can send crafted URL requests to read unauthorized data.

Finally, the October 2026 security hardening release resolves eight CVE groupings (CVE-2026-76490 through CVE-2026-76497) rated up to 8.6 CVSS. Cisco states that “These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” These grouped flaws cover out-of-bounds writes, reachable assertions, null pointer dereferences, uncaught exceptions, code injection, incorrect resource permissions, improper link resolution, and insecure temporary files.

Affected Versions

These Cisco Expressway vulnerabilities affect virtual and appliance versions of Cisco Expressway-C and Expressway-E. Specifically, CVE-2026-76466 and the eight hardening CVEs impact releases X14 and earlier. The vulnerabilities also affect X15.5.3 and earlier (with CVE-2026-76466 requiring clustering to be configured). Meanwhile, CVE-2026-76435 affects releases X14 and earlier, plus X15.5.2 and earlier.

Patch and Mitigation Steps

Cisco states that “There are no workarounds that address these vulnerabilities.” Administrators must upgrade affected Expressway Series deployments to version X15.5.3 to resolve CVE-2026-76435, and to version X15.5.20 to remediate CVE-2026-76466 and the eight hardening vulnerabilities.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.