Cisco patches maximum-severity root remote code execution in Expressway Series

Cisco patches maximum-severity root remote code execution in Expressway Series gateways

Cisco has released emergency software updates to remediate a maximum-severity remote code execution vulnerability impacting its widely deployed Expressway Series collaboration gateways. Formally catalogued as CVE-2026-76466 and assigned a near-maximum CVSS base score of 9.8, the flaw permits unauthenticated remote attackers to execute arbitrary system commands with root privileges on the underlying Linux operating system. The vulnerability exists within the clustered database service feature, where an architectural reliance on persistent cookies combines with broken client certificate validation to bypass all mutual authentication boundaries.

The flaw affects both physical appliances and virtualized deployments running Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E), as well as legacy TelePresence Video Communication Server (VCS) installations configured in cluster configurations. Because Expressway Edge gateways are routinely positioned on network perimeters and in DMZ segments to terminate external SIP, H.323, and WebRTC collaboration streams, an unauthenticated root compromise provides attackers with an immediate, high-value pivot into internal enterprise collaboration fabrics and corporate voice and video infrastructure.

According to the official advisory issued by the Cisco Product Security Incident Response Team (PSIRT), there are no configuration workarounds available to address the vulnerability. Network administrators operating clustered Expressway installations cannot mitigate the risk through settings adjustments or disabling specific sub-features. Immediate upgrade to software release X15.5.20 or later represents the sole definitive remediation, placing urgent upgrade demands on enterprise network operations and communications engineering teams globally.

Technical execution flow of the cluster database authentication bypass and root escalation

Zoom

Vulnerability metrics, affected product matrix, and severity scoring

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 by both Cisco PSIRT and the National Vulnerability Database (NVD). The CVSS vector string, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects network-based attack vector (AV:N), low attack complexity (AC:L), zero privileges required (PR:N), zero user interaction (UI:N), and maximum impact across confidentiality, integrity, and availability (C:H/I:H/A:H).

Table 1: Quantitative severity telemetry, defect identifiers, and operational attributes for CVE-2026-76466.

Metric Attribute	Value	Technical Description
Vulnerability Identifier	CVE-2026-76466	Official CVE designation for the Expressway database RCE
Cisco Bug ID	CSCww27732	Internal defect tracking number across engineering branches
Advisory Identifier	cisco-sa-vcs-static-cred-hr7EWZ8t	Official Cisco Security Advisory bulletin code
Common Weakness Enumeration	CWE-798	Use of Hard-coded Credentials / Persistent Cookies
CVSS v3.1 Base Score	9.8 (Critical)	Maximum remote unauthenticated execution score
Exploitability Sub-score	3.9	Reflects low complexity and zero authentication prerequisites
Impact Sub-score	5.9	Complete compromise of host confidentiality, integrity, and availability
Affected Products	Expressway-C, Expressway-E, VCS	Physical appliances and virtual machine (OVA) deployments
Vulnerable Versions	All releases prior to X15.5.20	When appliances are configured in a cluster
Fixed Release	X15.5.20 and later	Definitive vendor patch addressing cookie and cert verification

Anatomy of the cluster database authentication failure and remote command injection

The root cause of CVE-2026-76466 lies in the inter-node synchronization architecture of Cisco Expressway clusters. In enterprise video conferencing and call routing topologies, Expressway appliances frequently operate in redundant multi-node clusters (up to six peers) to replicate call state, routing rules, user registrations, and administrative configurations. Synchronization between clustered nodes relies on an internal database service running over dedicated network sockets.

To authenticate inter-node traffic, the database service employs static persistent cookies. However, when administrators configure clustering with TLS Verify Mode enabled, a logic defect within the service prevents proper validation of the presenting client certificate. Instead of enforcing strict mutual TLS (mTLS) verification where each peer must present a cryptographically valid certificate signed by a trusted internal Certificate Authority, the service accepts inbound connections solely upon possession of the persistent cookie, effectively discarding the certificate check.

Once an unauthenticated attacker establishes a connection to the database service using the static credentials, they can submit formatted Remote Procedure Call (RPC) requests. Because the service assumes that all authenticated connections originate from trusted internal cluster peers, incoming RPC arguments are dispatched directly to underlying system utility wrappers without adequate input sanitisation or shell escaping. This allows an attacker to inject arbitrary command strings into the execution stream, achieving remote code execution under the privileges of the database service process, which operates as root (uid=0).

Enterprise remediation roadmap, network segmentation, and hardening controls

Because Expressway Edge appliances often face untrusted network segments, defense-in-depth measures should be deployed immediately to isolate affected systems while firmware upgrades are scheduled across production maintenance windows.