Threat reportVulnerabilityTL-2026-4205
Critical Cisco Expressway Flaw (CVE-2026-76466) Lets Unauthenticated Attackers Execute Commands as Root
Critical Cisco Expressway Flaw (CVE-2026-76466) Lets (TL-2026-4205), also tracked as cisco-sa-vcs-static-cred-hr7EWZ8t, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-23. It has no confirmed attribution, affects Cisco Expressway Core (Expressway-C), references 1 CVE (CVE-2026-76466), maps to 4 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4205
- Threat ID
- TL-2026-4205
- Also known as
- cisco-sa-vcs-static-cred-hr7EWZ8t, CSCww27732
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise, telecoms, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How Critical Cisco Expressway Flaw (CVE-2026-76466) Lets works
Cisco Expressway Core (Expressway-C) and Edge (Expressway-E) contain a critical flaw (CVSS 9.8) in the clustered database service, caused by persistent cookies and inadequate TLS client certificate validation. An unauthenticated remote attacker could invoke RPC commands and execute arbitrary OS commands as root. Cisco PSIRT reports no known exploitation and no workarounds; X15.5.20 fixes it.
CVE-2026-76466 (Cisco advisory cisco-sa-vcs-static-cred-hr7EWZ8t, Cisco bug ID CSCww27732) affects the database service feature of Cisco Expressway Series when the appliance is deployed in a cluster. Per the Cisco advisory and NVD, the flaw involves persistent cookies and insufficient validation of TLS client certificates during clustering. The weakness is classified as CWE-798 (Use of Hard-Coded Credentials), matching the 'static-cred' advisory identifier.
An unauthenticated, remote attacker with network access to the cluster database service and possession of the relevant cookies could connect to the service and issue remote procedure call (RPC) commands. This results in arbitrary operating system command execution as root on the underlying Expressway appliance. Both virtual and physical (appliance) deployments running vulnerable releases with clustering enabled are affected. Expressway-E is typically internet-facing for mobile and remote access and B2B calling, so a compromise is a high-value pivot point between the perimeter and internal collaboration infrastructure; this deployment role is general product context and not stated in the advisory.
CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical; exploitability subscore 3.9, impact subscore 5.9). Affected: X14 and earlier and X15.5.3 and earlier (NVD lists the VCS/Expressway X8 through X15 lines, with X14.3.7 and X15.5.3 as the latest affected releases in their branches). Fixed: X15.5.20 is the first fixed release for the X15.5 train; customers on X14 or earlier must migrate to a fixed release. No workarounds exist. The issue was reported by Stefan Aleksic of Jane Street. At publication on 2026-10-21 Cisco PSIRT stated it was not aware of public announcements or malicious use. No public PoC, IOCs or network indicators have been published, so defensive effort should focus on patching, restricting network reachability of cluster database service traffic, and monitoring for anomalous cluster peer connections and unexpected root-level process activity on Expressway nodes.
MITRE ATT&CK techniques used in TL-2026-4205
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Credential Access
Affected products and versions in Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
Remediation for Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
Patches
- Cisco Expressway X15.5.20 (first fixed release for X15.5.3 and earlier)
- Advisory: cisco-sa-vcs-static-cred-hr7EWZ8t
Immediate actions
- Upgrade clustered Expressway-C and Expressway-E nodes to X15.5.20 or later
- Restrict network access to Expressway cluster peer/database service traffic to cluster members only
- Inventory all Expressway deployments and identify which are clustered and running X15.5.3 or earlier, or X14 or earlier
Workarounds
- None available per Cisco; upgrading is required
Longer-term hardening
- Migrate X14 and earlier deployments to a fixed release train
- Monitor Expressway nodes for unexpected root-level process execution and anomalous cluster peer connections
- Subscribe to Cisco PSIRT advisories for Expressway and VCS
CVEs associated with Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
Weaknesses (CWE) in Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
Timeline of Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
- Cisco PSIRT states it is not aware of public announcements or malicious use of the vulnerability at the time of publication.
- Cisco Expressway X15.5.20 is identified as the first fixed release; no workarounds are offered and X14 or earlier customers must migrate.
- CVE-2026-76466 published in NVD with CVSS 3.1 base score 9.8 and CWE-798.
- Cisco first publishes advisory cisco-sa-vcs-static-cred-hr7EWZ8t for CVE-2026-76466 affecting Expressway Core and Edge.
- GBHackers publishes coverage of the flaw, crediting Stefan Aleksic of Jane Street with the report (Cisco bug ID CSCww27732).
- Threadlinqs begins tracking CVE-2026-76466; no public PoC, IOCs or exploitation evidence identified in reviewed sources.
Sources cited for Critical Cisco Expressway Flaw (CVE-2026-76466) Lets
Detection coverage for TL-2026-4205
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4205 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.