Cisco has released a fix for a critical vulnerability in its Expressway collaboration gateways that could allow an attacker to run operating-system commands with root privileges. The flaw, tracked as CVE-2026-76466, carries a CVSS score of 9.8 and was published in a Cisco security advisory on 21 October 2026. It affects Expressway-C and Expressway-E systems only when they are configured in a cluster.

According to the advisory, the weakness sits in the database service used for clustering. Persistent cookies combined with insufficient checking of client certificates when TLS Verify Mode is enabled can allow an attacker who holds the required cookies and has network access to the affected device to connect to the database service and invoke remote procedure call commands. Those commands can then be used to execute code as root, the highest level of access on the system.

No workaround: upgrade is the fix

Cisco states there is no workaround for this flaw. Systems running X15.5.3 and earlier should be upgraded to X15.5.20, while systems on X14 and earlier must migrate to a fixed release, since no fixed release exists on that older train. Administrators should also restrict which networks can reach clustering and database-service ports, keeping that internal cluster traffic away from the general internet and untrusted networks.

At the time of its advisory, Cisco said it was not aware of public announcements or malicious use of the flaw, and no public exploit code had been reported. That position can change quickly once a patch is public, so clustered and especially internet-facing Expressway-E nodes should be prioritised. The Expressway flaw is separate from the Cisco Secure Email Gateway flaw already covered on this site: it affects a different product, carries a different CVE number, and has its own fixed release.