Skip to content
VulniPulse
Sign in
Advisory severityCritical9.8Cisco Updated

Critical [CVE-2026-76466] Cisco Expressway Series Remote Code Execution Vulnerability

This critical-severity Cisco advisory covers CVE-2026-76466 affecting TelePresence Video Communication Server (VCS) Expressway.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

cisco-sa-vcs-static-cred-hr7EWZ8t Source published Source updated

VulniPulse record published Record updated

CVE-2026-76466
Affected products & platforms
CiscoUnified Communications
Open source advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.

This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated.

An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device.

Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.

Affected product named by the advisory: TelePresence Video Communication Server (VCS) Expressway.

Affected versions
  • Scope: This vulnerability affects Cisco Expressway-C and Cisco Expressway-E, both virtual and appliance versions, if they are running a vulnerable release and have the devices configured in a cluster.
  • X14 and earlier — Migrate to a fixed release
  • Release X15.5.3 and earlier (first fixed: X15.5.20)

Official advisory · high-confidence parse· fetched 14 hours ago·verify at source

Fixed versions
  • X15.5.20

Official advisory · high-confidence parse· fetched 14 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release X14 and earlier: migrate to a fixed release.
  • Release X15.5.3 and earlier: upgrade to X15.5.20.
Workaround status
  • There are no workarounds that address this vulnerability.

Official advisory · high-confidence parse· fetched 14 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.