CVE-2026-76466
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability in the database service of Cisco Expressway Series is caused by the use of persistent cookies and insufficient validation of client certificates when TLS Verify Mode is enabled for clustering. An unauthenticated remote attacker with network access can connect to the database service and invoke specific RPC commands, allowing execution of arbitrary operating system commands as root.
Risk Assessment
This allows an unauthenticated attacker to fully compromise a Cisco Expressway (Core or Edge) device and execute commands as root. It poses a critical risk to the confidentiality, integrity, and availability of the communications infrastructure.
Recommendation
Immediately apply the security update provided by Cisco for Cisco Expressway Series. Until patched, restrict network access to the database service and review clustering and client certificate configuration.
Other vulnerabilities in Cisco Expressway Series
See all- CVE-2026-76497Medium
Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.
- CVE-2026-76496High
Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).
- CVE-2026-76495High
Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).
- CVE-2026-76494High
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.
- CVE-2026-76493High
Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76492High
Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76491High
Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76490High
Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-76435Medium
A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.
Original NVD description (English source)
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS