# Critical Cisco Expressway Flaw (CVE-2026-76466) Lets Unauthenticated Attackers Execute Commands as Root

> Cisco Expressway Core (Expressway-C) and Edge (Expressway-E) contain a critical flaw (CVSS 9.8) in the clustered database service, caused by persistent cookies and inadequate TLS client certificate validation. An unauthenticated remote attacker could invoke RPC commands and execute arbitrary OS commands as root. Cisco PSIRT reports no known exploitation and no workarounds; X15.5.20 fixes it.

- **Published:** 2026-10-23T01:55:10Z
- **Last reviewed:** 2026-10-23T01:55:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4205
- **ID:** TL-2026-4205
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-76466

## Description

CVE-2026-76466 (Cisco advisory cisco-sa-vcs-static-cred-hr7EWZ8t, Cisco bug ID CSCww27732) affects the database service feature of Cisco Expressway Series when the appliance is deployed in a cluster. Per the Cisco advisory and NVD, the flaw involves persistent cookies and insufficient validation of TLS client certificates during clustering. The weakness is classified as CWE-798 (Use of Hard-Coded Credentials), matching the 'static-cred' advisory identifier.

An unauthenticated, remote attacker with network access to the cluster database service and possession of the relevant cookies could connect to the service and issue remote procedure call (RPC) commands. This results in arbitrary operating system command execution as root on the underlying Expressway appliance. Both virtual and physical (appliance) deployments running vulnerable releases with clustering enabled are affected. Expressway-E is typically internet-facing for mobile and remote access and B2B calling, so a compromise is a high-value pivot point between the perimeter and internal collaboration infrastructure; this deployment role is general product context and not stated in the advisory.

CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical; exploitability subscore 3.9, impact subscore 5.9). Affected: X14 and earlier and X15.5.3 and earlier (NVD lists the VCS/Expressway X8 through X15 lines, with X14.3.7 and X15.5.3 as the latest affected releases in their branches). Fixed: X15.5.20 is the first fixed release for the X15.5 train; customers on X14 or earlier must migrate to a fixed release. No workarounds exist. The issue was reported by Stefan Aleksic of Jane Street. At publication on 2026-10-21 Cisco PSIRT stated it was not aware of public announcements or malicious use. No public PoC, IOCs or network indicators have been published, so defensive effort should focus on patching, restricting network reachability of cluster database service traffic, and monitoring for anomalous cluster peer connections and unexpected root-level process activity on Expressway nodes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1552.001 Unsecured Credentials: Credentials In Files

## Sources

- [Cisco Security Advisory cisco-sa-vcs-static-cred-hr7EWZ8t](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)
- [NVD - CVE-2026-76466](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-76466)
- [Critical Cisco Expressway Flaw Lets Attackers Execute Commands as Root (GBHackers)](https://gbhackers.com/critical-cisco-expressway-flaw-2/)
- [Cisco Expressway / TelePresence VCS Security Advisories List](https://www.cisco.com/c/en/us/support/unified-communications/telepresence-video-communication-server-vcs/products-security-advisories-list.html)
- [CWE-798: Use of Hard-coded Credentials](https://cwe.mitre.org/data/definitions/798.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4205