A cluster of Cisco Expressway video gateways can give a remote attacker root command execution if the attacker has a persistent database-service cookie and network access to a gateway. Cisco’s October 21 advisory assigns CVE-2026-76466 a critical 9.8 score. It covers clustered Expressway-C and Expressway-E devices, both appliances and virtual deployments, on vulnerable releases.
Cisco says that with clustering’s TLS Verify Mode set to Enabled, “client certificates are not validated.” An operator looking only at that setting could mistake it for a working check on database-service clients.
Cookies Meet an Unchecked Client
The database service uses persistent cookies. A remote party holding them can connect to that service and invoke specific remote procedure calls while client certificates go unvalidated under the Enabled cluster setting, Cisco says. Successful exploitation runs arbitrary operating-system commands as root. That grants the attacker the device’s highest-privilege account.
Cisco credits Stefan Aleksic of Jane Street with reporting the flaw and tracks it as CSCww27732. Its Product Security Incident Response Team says it is unaware of public announcements or malicious use.
Cluster Inventory Sets the Scope
Identify Expressway-C and Expressway-E cluster members in the communications estate and record each member’s installed release and whether it is clustered. Cisco limits this CVE to appliance and virtual deployments when configured in a cluster and running a vulnerable release.
Cisco lists X15.5.3 and earlier in the X15 line as vulnerable and X15.5.20 as the first fixed release. For X14 and earlier, Cisco directs customers to migrate to a fixed release. Plan the upgrade against the vendor’s release table for each clustered member; comparing only a major-version label misses the fixed-build threshold. Cisco says there are no workarounds that address the vulnerability.
Patch and Verify the Cluster
Upgrade affected clustered members to an appropriate fixed release, X15.5.20 for the listed X15 branch, and migrate X14 and older deployments to a fixed release. Until the upgrade is complete, restrict database-service network access to required cluster peers through network policy as an exposure-reduction measure, while treating the Cisco upgrade as the fix. Compare the resulting member inventory with the installed versions after maintenance; the expected state is that every clustered member runs a release the Cisco table marks fixed.
Review firewall or network-flow records for connections to the database service from systems outside the intended cluster, especially where a cookie may have been exposed. For incident triage, correlate those connections with each member’s version and investigate unexplained cookie access.