Cisco published a critical advisory on Oct 21 for CVE-2026-76466 in Expressway-C and Expressway-E (virtual and appliance). The database service uses persistent cookies, and when TLS Verify Mode is enabled for clustering, client certificates aren't actually validated. An attacker who has the cookies and network access can call RPC commands on the database service and run OS commands as root.

• Affected: clustered Expressway devices on X15.5.3 and earlier. Fixed: X15.5.20. X14 and earlier must migrate to a fixed release. Cisco says there are no workarounds.
• Cisco PSIRT says it isn't aware of public announcements or malicious use.
• Same day, Cisco shipped an Expressway Security Hardening Release (eight grouped CVEs, CVE-2026-76490 to -76497, up to CVSS 8.6, found internally) and a Unified Communications Products Security Hardening Release rated Critical 9.8, plus medium-severity Expressway and Unified CM bugs.

Do now: Expressway-E sits at the edge, so upgrade clustered pairs to X15.5.20 first, and restrict the clustering/database ports to peer nodes only until you do.