Cisco Expressway Series database service flaw enables unauthenticated root command execution (CVE-2026-76466)

What happened

CVE-2026-76466 is a critical vulnerability in the database service feature of Cisco Expressway Series. It stems from the use of persistent cookies and from insufficient validation of client certificates when TLS Verify Mode is set to Enabled for clustering. An attacker with possession of the cookies can connect to the database service and invoke specific remote procedure call commands. A successful exploit allows the attacker to execute arbitrary commands as root on the underlying operating system of the device.

The CVSS 3.1 score is 9.8, with a network attack vector, low complexity, no privileges, and no user interaction. Cisco PSIRT states it is not aware of any public announcements or malicious use of this vulnerability.

Who is affected

The affected product is Cisco TelePresence Video Communication Server (VCS) Expressway, covering Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices. Cisco lists the affected versions as X8.1.1, X8.2.2, X8.6, X8.8.3, X8.11.0, X8.11.2, X8.11.3, and X12.5.2. The database service is the exploitable component.

What to do now

1. Apply Cisco's fixed software. Cisco has made a fix available and states that no workarounds address this vulnerability. No specific fixed release is listed in the data shown with this page, so confirm the exact release for your affected version in Cisco's advisory before deploying.
2. Until patched, restrict network access to the database service on Expressway-C and Expressway-E devices. The attack path requires network access to this service, so limit reachability to trusted management and clustering networks. Cisco states there are no workarounds, so this is a temporary containment measure rather than a fix.

How to detect it

Confirm whether the database service on affected Expressway-C and Expressway-E devices is reachable from untrusted networks; the exploit requires network access to that service. Successful exploitation executes operating system commands as root, so review root-level process execution and command history for unexpected activity. Cisco has not published specific indicators of compromise.

Beyond the patch

For a collaboration edge device, a pre-authentication route to root makes exposed services the first order of business. If the Expressway database service is reachable from beyond trusted management or clustering networks, that exposure should be found before it is exploited; Virtual CISO Services (vCISO) can provide that exposure view. Root-level command execution also leaves telemetry that Managed Detection & Response (MDR) is built to detect across EDR and SIEM.