Cisco Expressway database service remote code execution lets unauthenticated attackers run commands as root (CVE-2026-76466)

What happened

An unauthenticated attacker who can reach a Cisco Expressway device over the network can exploit this vulnerability to execute operating system commands as root. The vulnerability stems from the database service's use of persistent cookies. In addition, when TLS Verify Mode is set to Enabled for clustering, client certificates are not validated. An attacker in possession of the cookies can connect to the database service and invoke specific remote procedure call commands.

The CVSS vector describes a network-level attack with low complexity, no privileges and no user interaction, with high impact across confidentiality, integrity and availability. Cisco rates the issue critical with a 9.8 score. Cisco PSIRT states it is not aware of any public announcements or malicious use of the vulnerability.

Who is affected

Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices. In the CVE record, the affected product is Cisco TelePresence Video Communication Server (VCS) Expressway, and Cisco lists these releases: X8.1.1, X8.2.2, X8.6, X8.8.3, X8.11.0, X8.11.2, X8.11.3 and X12.5.2. If your deployment is on one of these releases, treat it as affected. Expressway devices typically provide call control, traversal and firewall connectivity for video conferencing, and are often internet-facing, which makes this flaw particularly urgent to validate.

What to do now

1. Apply Cisco's fix. Cisco indicates fixed software is available. Review Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t for the release path relevant to your deployment, and apply it through your normal Cisco update process as soon as possible.
2. Because Cisco states there are no workarounds, restrict network access to the database service and to Expressway management interfaces until the update is applied. Allow connections only from trusted administrative networks and monitor for unexpected traffic.
3. After updating, verify that the device is running a fixed release and confirm that no unauthorised accounts or configuration changes were introduced before patching.

How to detect it

Cisco has not published specific indicators of compromise for this vulnerability. Because the attack path is an unauthenticated connection to the database service, review logs for unexpected connections to the database service and for new or unusual processes running as root on affected Expressway devices. Also check for account changes made around the time of suspicious database service activity.

Beyond the patch

Beyond patching, this is a reminder that internet-facing infrastructure must be mapped as exposure, not assumed safe. Virtual CISO Services helps identify services and ports reachable without credentials, which is the exposure that lets this kind of vulnerability matter. Managed Detection & Response provides the monitoring that can catch root-level command execution and account abuse on devices like Expressway after a compromise attempt.