CVE-2026-76466
How to tell if CVE-2026-76466 (Cisco Expressway clusters) is reachable in your environment
Reachable if a Cisco Expressway-C or Expressway-E configured in a cluster runs X15.5.3 or earlier, or X14 and earlier, and something other than its cluster peers can reach it over the network. No login is required, per Cisco.
Working exploit code now exists for a Cisco Expressway flaw that Cisco fixed on October 21, 2026. A clustered Expressway that hasn't moved to X15.5.20 is the target. CVE-2026-76466 lets an unauthenticated attacker with network access to a clustered Expressway-C or Expressway-E run operating system commands as root, per Cisco. Cisco rates it 9.8 and lists no workarounds.
Standalone Expressway devices are not affected; Cisco says only devices configured in a cluster are. Public code posted November 5 reports running a command as root on a real two-node Expressway-C X15.3.2 cluster. Cisco's advisory, unchanged since October 21, says Cisco is not aware of public announcements or malicious use. The flaw is not on CISA's Known Exploited Vulnerabilities catalog as of the November 10, 2026 release.
Is it reachable for you?
What it is. Cisco says the flaw is in the database service feature of Cisco Expressway Series and lets an unauthenticated, remote attacker with network access to an affected device run operating system commands as root. Cisco classifies it as use of hard-coded credentials (CWE-798). Cisco's description also says client certificates are not validated even when the TLS Verify Mode for clustering is set to Enabled, so do not count that setting as protection.
Affected, per Cisco. Expressway-C and Expressway-E, virtual and appliance, running a vulnerable release and configured in a cluster. X15.5.3 and earlier are fixed in X15.5.20. X14 and earlier must migrate to a fixed release.
Checks, in three tiers. The first two decide exposure. The third decides priority. Run these only on systems your organization owns.
- Is the Expressway clustered? In the web interface, open System > Clustering and check whether cluster peers are configured. A standalone Expressway is out of scope.
- Is it on an affected release? Check the software version on each peer. Anything at X15.5.3 or earlier, or on X14 and earlier, is affected. Every peer in the cluster needs the fixed release.
- Can anything other than its own peers reach it? Cisco says the attacker needs network access to the device. Cisco's clustering guide says a single-NIC Expressway-E builds its cluster on its public IP address, so check those first. Test from the internet and from user networks whether anything other than the cluster peers can connect to each peer.
Identities involved. Commands would run as root on the Expressway. Check what the Expressway can reach from there, including call control systems, directory services and the credentials stored in its configuration.
Compensating controls (test them, don't assume them)
Cisco lists no workarounds for CVE-2026-76466. Upgrading to X15.5.20, or migrating from X14 and earlier to a fixed release, is the fix.
What to look for in logs
Cisco has published no indicators of compromise. General signals to review on clustered Expressway peers are below.
- Connections to a cluster peer from addresses that are not other peers in the same cluster.
- Configuration changes, new accounts or new files on an Expressway that no administrator made.
- Outbound connections from an Expressway that do not match normal call and management traffic.
FAQ
Am I exposed to CVE-2026-76466?
You may be if you run Cisco Expressway-C or Expressway-E configured in a cluster on X15.5.3 or earlier, or on X14 and earlier, and something other than the cluster peers can reach it over the network. No login is needed, per Cisco. Standalone Expressway is not affected.
Is CVE-2026-76466 being exploited?
No exploitation has been reported. Cisco says it is not aware of malicious use, and it is not on CISA KEV as of the November 10, 2026 catalog. Public code posted November 5 reports running a command as root on a real Expressway-C cluster.
Is there a patch?
Yes. Cisco fixed it on October 21, 2026 in X15.5.20. X14 and earlier must migrate to a fixed release.
Is there a workaround?
Cisco lists none. Upgrading is the fix.
Does setting TLS Verify Mode to Enabled protect me?
No. Cisco's description says client certificates are not validated even when TLS Verify Mode is Enabled for clustering.
- Vendor
- Cisco
- Product
- Cisco Expressway Series: Expressway-C and Expressway-E, virtual and appliance, when configured in a cluster
- Affected versions
- Cisco Expressway X15.5.3 and earlier (fixed in X15.5.20); X14 and earlier must migrate to a fixed release. Only devices configured in a cluster are affected, per Cisco
- Vulnerable component
- Expressway database service used by clustering
- CVSS
- 9.8 Critical (Cisco as CNA, CVSS 3.1). NVD has not added its own score
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Cisco)
- CWE
- CWE-798, Use of Hard-coded Credentials (Cisco)
- Exploitation
- Not observed
- CISA KEV added
- Patch
- Cisco Expressway X15.5.20 for X15.5.3 and earlier; X14 and earlier must migrate to a fixed release. The fix is also part of Cisco's Expressway Series Security Hardening Release: October 2026
Updates
Nov 11, 2026. First published. Cisco fixed the flaw on October 21 in X15.5.20; public code posted November 5 reports root command execution on a real Expressway-C cluster; Cisco reports no malicious use; not on CISA KEV.
Sources
- Cisco Security Advisory cisco-sa-vcs-static-cred-hr7EWZ8t (version 1.0, Oct 21, 2026; Cisco bug CSCww27732; reported to Cisco by Stefan Aleksic of Jane Street)
- CVE record CVE-2026-76466 (CNA Cisco)
- NIST NVD: CVE-2026-76466 (no NVD score, checked Nov 11)
- Cisco, What is Expressway cluster and how it works
- Public exploit code, dinosn/cve-2026-76466 (posted Nov 5, 2026; read only, not run)
- CISA Known Exploited Vulnerabilities catalog (not listed; checked catalog version 2026.11.10)
We publish an advisory when a vulnerability is Critical or on CISA KEV, has one identifiable component to check, and has a public proof of concept or reported exploitation. Advisories are updated as exploitation status changes.