Executive Summary

On October 21st, 2026, Cisco disclosed a critical vulnerability in its Expressway Series collaboration gateways. Tracked as CVE-2026-76466, the flaw lets an unauthenticated, remote attacker with network access to the device execute operating system commands as root by abusing the Expressway database service. Both Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) devices are affected.

Expressway connects Cisco collaboration services to users and partners outside the corporate network, and Expressway-E is deployed at the network edge. Root access would give an attacker full control of an appliance that bridges internal and external networks. Threat actors have repeatedly targeted Cisco perimeter products during 2026, most recently a Secure Email Gateway flaw that Cisco confirmed as exploited on October 14th.

At the time of writing, there are no public reports of exploitation and no public proof-of-concept (PoC). Cisco states there are no workarounds. Given the root-level impact, the edge placement of Expressway-E, and recent attacks on Cisco perimeter devices, Beazley Security recommends affected organizations apply available fixes as soon as possible.

Affected Systems or Products

Product

Affected Versions

Fixed Versions

Cisco Expressway Series (Expressway-C and Expressway-E)

< X15.5.20

X15.5.20

Cisco notes in their bulletin that any users in X14 or previous should upgrade to supported versions.

Mitigations / Workarounds

Cisco states there are no workarounds for this vulnerability. Cisco lists the affected and fixed releases in its advisory, and upgrading to a fixed release is the only remediation. The steps below reduce exposure but do not replace the upgrade.

If patching cannot be immediately applied, the following may help to temporarily reduce risk:

  • Restrict network access to the Expressway database service and cluster communication so that only the other peers in the Expressway cluster can reach it.

  • On Expressway-E, confirm through perimeter firewall rules that the database service cannot be reached from the internet or other untrusted networks.

Patches

Cisco has released software updates that address CVE-2026-76466 and documents the fixed releases in its advisory. Cisco also published the Cisco Expressway Series Security Hardening Release: October 2026 the same day, which documents additional Expressway fixes to consider when planning the upgrade.

Technical Details

CVE-2026-76466 resides in the database service feature of Cisco Expressway Series software. Cisco attributes the flaw to two weaknesses. First, the service relies on persistent cookies. Second, client certificates are not validated when the TLS Verify Mode for clustering is set to Enabled, so the service does not confirm that a connecting client is a legitimate cluster peer.

An unauthenticated attacker who possesses the cookies and has network access to the device can connect to the database service and invoke specific remote procedure call (RPC) commands. Cisco states that a successful exploit lets the attacker execute arbitrary commands as root on the underlying operating system. Cisco has not described how an attacker would obtain the cookies, which RPC commands are involved, or which network ports the database service exposes.

Cisco has published limited technical details, and no public PoC is known at the time of writing. Cisco disclosed the flaw on the same day as the Cisco Expressway Series Security Hardening Release: October 2026, a High-rated release that groups internally discovered Expressway issues by vulnerability class under eight CVE identifiers. Cisco states those issues were found during internal testing and are not known to be actively exploited.

How Beazley Security is responding

Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.

We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.

If you believe your organization may have been impacted by this vulnerability and need support, please contact our Incident Response team.

Sources