A working public exploit is now available for a critical flaw in Cisco Expressway that lets an unauthenticated attacker run commands as root on clustered video and voice gateways. Security researcher Nicolas Krassas, known as dinosn, published the proof-of-concept exploit and a fleet detection tool on GitHub on Thursday 12 November, raising the urgency for organisations that have not yet patched.

The flaw, tracked as CVE-2026-76466 and rated 9.8 out of 10, was first disclosed by Cisco on 21 October 2026. It comes from hard-coded credentials in the cluster manager of clustered Expressway-C and Expressway-E deployments. Cisco has said there is no workaround, and the only fix is to upgrade to release X15.5.20.

Expressway gateways sit at the edge of corporate networks, connecting internal video and voice systems to the outside world, which makes them easy for attackers to find and a valuable target. Cisco's security team said it knew of no malicious exploitation when it published its advisory, but a public exploit changes that calculation.

How the exploit works

The vulnerability sits in the cluster database service, which runs on Erlang/OTP. Each cluster node listens for Erlang distribution traffic on TCP port 4372 over TLS, and the nodes authenticate to each other using a shared cookie.

According to the researcher's analysis, the cluster manager component, known as cm_server, admits a hard-coded maintenance identity, wombat@, which uses the legacy TANDBERG prefix, into its allowed-node set, and installs a matching hard-coded cookie at the same time. Both values are compiled into the software, so they are identical on every installation of the affected releases.

In TLS Permissive mode, which is the factory default, the server does not validate client certificates. Any client that knows the identity and the cookie can therefore complete the handshake and issue remote procedure calls. The attack is short: the attacker opens a TLS 1.3 connection to port 4372, completes the Erlang handshake as wombat@127.0.0.1, answers the challenge with the hard-coded cookie, and calls os:cmd to run an operating system command. In the researcher's test, the command id -u returned 0, confirming root privileges.

The published exploit includes probe, ping and uid modes. The ping mode only authenticates to a target without running commands, so defenders can use it to test whether their own systems are exposed.

What is affected and the fix

CVE-2026-76466 affects clustered Expressway-C and Expressway-E, both virtual and physical appliances, running X15.5.3 and earlier. The fix is release X15.5.20. Systems on X14 and earlier have no fix on their own release line and must migrate to a fixed release.

The researcher validated the exploit on Expressway-C X15.3.2 in a two-node cluster running in TLS Permissive mode. TLS Enforcing mode, Expressway-E deployments, X14 releases and the fixed X15.5.20 build were not tested, so administrators should not assume those configurations are safe without checking.

What administrators should do now

Cisco's advice is to upgrade clustered systems to X15.5.20 without delay. Until patching is done, administrators should restrict TCP ports 4371 and 4372 so that only authorised cluster peers can reach them, and should raise alerts on connections from any other address.

For triage, teams should inventory their clustered nodes, check the release numbers, confirm whether the cluster ports are reachable from networks outside the cluster, and run the ping check from the published tool against each node. Any system still on an affected release with those ports exposed to the internet should be treated as a priority.

Sources: GBHackers, Cisco and Carthage Electronics.