CVE-2026-76466

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series versions prior to X15.5.20

Description An unauthenticated remote attacker with network access to Cisco Expressway Core (Expressway-C) or Cisco Expressway Edge (Expressway-E) devices can execute arbitrary operating system commands as root. This issue stems from the use of persistent cookies and insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering. An attacker possessing these cookies can connect to the database service and invoke specific remote procedure call (RPC) commands to gain root access to the underlying operating system.

Recommendations Update to version X15.5.20.