---
title: Cisco Expressway CVE-2026-76466 (CVSS 9.8): unauthenticated root command execution through the clustering database service; fixed in X15.5.20, no workaround | ctxsec
url: https://ctxsec.com/items/cisco-expressway-cve-2026-76466-root-rce
description: ""
status: "confirmed (Cisco PSIRT advisories, Oct 21); Cisco not aware of exploitation"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/cisco-expressway-cve-2026-76466-root-rce.md)

confirmed (Cisco PSIRT advisories, Oct 21); Cisco not aware of exploitation

2026-10-21

### Cisco Expressway CVE-2026-76466 (CVSS 9.8): unauthenticated root command execution through the clustering database service; fixed in X15.5.20, no workaround

Cisco published a **critical** advisory on **Oct 21** for **CVE-2026-76466** in **Expressway-C and Expressway-E** (virtual and appliance). The database service uses **persistent cookies**, and when **TLS Verify Mode** is enabled for clustering, client certificates aren't actually validated. An attacker who has the cookies and network access can call RPC commands on the database service and run OS commands as **root**.

- **Affected:** clustered Expressway devices on X15.5.3 and earlier. **Fixed:** X15.5.20. X14 and earlier must migrate to a fixed release. Cisco says there are no workarounds.
- Cisco PSIRT says it isn't aware of public announcements or malicious use.
- Same day, Cisco shipped an **Expressway Security Hardening Release** (eight grouped CVEs, CVE-2026-76490 to -76497, up to CVSS 8.6, found internally) and a **Unified Communications Products Security Hardening Release** rated Critical 9.8, plus medium-severity Expressway and Unified CM bugs.

**Do now:** Expressway-E sits at the edge, so upgrade clustered pairs to X15.5.20 first, and restrict the clustering/database ports to peer nodes only until you do.

Sources: [Cisco: Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t) · [Cisco: Expressway Series Security Hardening Release, October 2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs) · [Cisco: Advance Notification for October 21, 2026 advisories](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-QGwHnJ6k)