Cisco has released security patches to address a critical vulnerability in its Expressway Series, allowing unauthenticated remote attackers to execute operating system commands with root privileges This article explores vulnerability expressway. . The flaw, tracked as CVE-2026-76466, has a CVSS base score of 9.8 and impacts Expressway deployments configured in clusters.
The vulnerability affects the database service feature used by Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). The advisory highlights that insufficient client certificate validation occurs when the clustering configuration uses TLS Verify Mode set to Enabled. Despite this setting, the system fails to validate client certificates, thereby bypassing the intended security measures.
An attacker with access to the necessary cookies and network privileges can connect to the affected Expressway device and execute remote procedure calls (RPCs) to invoke commands as root, potentially gaining unauthorized access. Before upgrading, customers should ensure sufficient device memory and confirm that their hardware and software configurations remain supported by the target release, following Cisco’s upgrade guidance. Utilize ANY.RUN to join 16,000+ SOC teams and streamline threat investigations, reducing manual effort.
Explore ANY.RUN for your team.
