External risk intelligence

Cisco Expressway Remote Code Execution via Database Service

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-76466

Cisco Expressway-E devices are designed to be deployed at the network edge to facilitate remote access and collaboration services, making them inherently public-facing. This vulnerability affects the database service on these devices, which are commonly exposed to the internet to support external connectivity, identity, and communication protocols.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Cisco Expressway Series devices, specifically impacting their database service. The flaw could allow an unauthorized remote attacker to execute commands with full system control, posing a significant risk to the integrity of these communication platforms.

Attacker can run any command on the device.
This affects external-facing communication systems.
Confirm relevance and exposure of Cisco Expressway devices.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access to a Cisco Expressway device could exploit this vulnerability. The attacker would need to possess persistent cookies and connect to the database service to invoke specific remote procedure calls. A successful exploit could result in the execution of arbitrary operating system commands with root privileges on the affected device.

Network access required.
Possess cookies, invoke RPC commands.
Execute arbitrary commands as root.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary commands as root on Cisco Expressway devices with network access. This is possible when persistent cookies are used and client certificates are not properly validated for clustering.

System commands and root access.
Exploiting persistent cookies and certificate validation.
Complete system compromise and control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Cisco Expressway devices, particularly those deployed at the network edge for external connectivity, are likely managed by infrastructure or platform teams, with network and security teams responsible for their perimeter exposure. The first practical step is to identify all Expressway deployments, confirm their reachability and business criticality, and then determine the accountable owner to plan remediation based on risk and scheduled maintenance.

Infrastructure or Platform Teams own the issue.
Verify external reachability and business impact.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Cisco Expressway Series?

Cisco Expressway Series consists of Expressway-C (Core) and Expressway-E (Edge) devices. These systems act as gateways to facilitate secure remote access, video conferencing, and collaboration services, allowing organizations to connect internal communication platforms with external networks and remote users.

What does CVE-2026-76466 mean for system security?

This vulnerability is classified as CWE-798, which involves the use of hard-coded credentials or improper authentication handling. In this case, the reliance on persistent cookies and failing to properly validate client certificates allows unauthorized actors to bypass security controls, enabling them to execute arbitrary system commands with root-level privileges.

How is this Cisco Expressway vulnerability triggered?

An attacker must have network access to the device and possess the necessary persistent cookies to interact with the database service. Simply having network reachability is insufficient; the attacker specifically needs to use those cookies to invoke targeted remote procedure calls (RPC). The flaw does not trigger through standard traffic that lacks these specific cookies and RPC commands.

Is my organization at risk from this vulnerability?

Halo Surface Signal indicates that Cisco Expressway-E devices are particularly relevant because they are architected to sit at the network perimeter to provide remote access, making them frequently internet-facing. If your Expressway devices are reachable from the public internet to support external communication, they face a higher risk profile than those restricted to internal-only segments.

What should I do if I manage Cisco Expressway devices?

Begin by auditing your environment to map every Expressway deployment and determine which are internet-facing. Once identified, coordinate with the infrastructure or platform teams responsible for these systems to verify their configuration and business criticality. Prepare for upcoming maintenance windows to apply the necessary updates or security configurations once provided by the vendor.

References

sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.