1-minute read
What a defender needs to know
Cisco’s October 21 advisory describes a critical root-command path in clustered Expressway-C and Expressway-E video gateways, including virtual and appliance deployments. An attacker must possess persistent database-service cookies and have network access to the device. With clustering’s TLS Verify Mode set to Enabled, client certificates still go unvalidated; the attacker can use the cookies to reach database-service remote procedure calls and execute operating-system commands as root. Cisco assigns CVE-2026-76466 a 9.8 score and says its response team is unaware of malicious use.
Inventory the Expressway-C and Expressway-E cluster members and record both their installed release and cluster configuration. X15.5.3 and earlier in the X15 line are affected; X15.5.20 is the first fixed release. Cisco directs X14 and earlier deployments to migrate to a fixed release. Upgrade each affected clustered member and compare its installed build with Cisco’s fixed-release table after maintenance. Before the upgrade is complete, restrict database-service network access to required cluster peers through network policy as an exposure-reduction measure. Cisco says there is no workaround that addresses this vulnerability.
Review firewall or flow records for database-service access from outside intended peers where cookie exposure is suspected. Correlate unexpected connections with the installed version and investigate cookie exposure. A passing check is a cluster inventory showing each affected member on the appropriate fixed release.