Cisco Expressway clusters open to root code execution, fixed in X15.5.20

Cisco Expressway clusters open to root code execution, fixed in X15.5.20

21 October 2026: Cisco has fixed CVE-2026-76466, a critical flaw (CVSS 9.8) in Expressway-C and Expressway-E that lets an attacker who is not logged in, but can reach the system over the network, run operating system commands as root. Only clustered deployments are exposed, there is no workaround, and the first fixed release is X15.5.20; Cisco says it knows of no public exploit or malicious use.

Fixed releases

Expressway release	First fixed
X15.5.3 and earlier	X15.5.20
X14 and earlier	migrate to a fixed release

Both the virtual and appliance editions are affected when they run a vulnerable release and are configured in a cluster.

How cluster trust becomes a way in

Expressway nodes in a cluster talk to each other over TLS, and Cisco's advisory traces the flaw to two weaknesses in that conversation: persistent cookies, and client certificates that are not properly validated when TLS Verify Mode is enabled for clustering. With those cookies an attacker can reach the cluster's database service and call specific remote procedures that end in command execution as root. The bug was reported by Stefan Aleksic of Jane Street.

Expressway is the gateway many organisations put at the edge for Cisco calling and meetings, including Mobile and Remote Access, which lets staff outside the office register to Unified CM without a VPN. Expressway-E in particular faces the internet, which makes "network access" a low bar for some of these deployments.

The other Expressway and Unified CM fixes

The same publication brings two Medium flaws. CVE-2026-76435 (CVSS 5.3) lets an unauthenticated attacker read information through a crafted URL during Mobile and Remote Access provisioning; it is fixed in X15.5.3. CVE-2026-76487 (CVSS 5.3) is an access control flaw in Unified CM and Unified CM Session Management Edition, fixed in 15SU5, with release 14 users told to migrate. Canada's Cyber Centre bulletin AV26-1073 lists the wider set from the same day, including Snort 3, Secure Client, Cyber Vision and IOS XR.

Teams running an X15 cluster have a short path to X15.5.20, and Cisco folds the same fix into its October Expressway hardening release. Those still on X14 face a migration rather than a patch, and in the meantime the only lever is who can reach the cluster's interfaces at all. Our unified communications software category lists 17 products.

Related on TrustList:

• FreeSWITCH flaw lets one SIP MESSAGE run server commands
• Mitel fixes OpenScape Endpoint Management bypass; Brotli fix planned
• Slican fixes three flaws in IPx phone exchanges; old models stay exposed

Sources

• Cisco: Cisco Expressway Series Remote Code Execution Vulnerability (cisco-sa-vcs-static-cred-hr7EWZ8t), 21 October 2026
• Cisco: Cisco Expressway Information Disclosure Vulnerability (cisco-sa-expressway-inf-disc-vvYqgSTS), 21 October 2026
• Canadian Centre for Cyber Security: Cisco security advisory (AV26-1073), 21 October 2026