CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Expressway Select Series

product · product:cisco-expressway-select-series single-source

Coverage
1
first 2026-10-28 → last 2026-10-28
Latest activity
2026-10-28
Cisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco knows of no…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
2 hosts

Action items (1)

Do-now tasks recorded on the entries about Cisco Expressway Select Series, newest first. Check the date before acting on an older one.

  • Upgrade every Cisco Expressway-C, Expressway-E and Expressway Select unit to 15.5.21, including units already moved to X15.5.20 for CVE-2026-76466, which Cisco's table does not name as the PHP2Shell fix, and until then apply the workaround in bug CSCwx37062; take any Duo Access Gateway to 3.2.0.
    2026-10-28CVE-2026-109618 +1

Defender insights

What each entry about Cisco Expressway Select Series tells a defender to do, newest first.

2026-10-28NOTABLEexploitedCisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco knows of no malicious use

Exposure · detection

Story timeline

  1. 2026-10-28CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products
    trending-vulnerabilitiesCisco's final PHP2Shell advisory: Expressway needs 15.5.21, Duo Access Gateway 3.2.0; Cisco knows of no malicious use

Hunting pivots

CVEs (exploited first)
CVE-2026-109618CVE-2026-109619
Releases covered
Cisco Expressway Select Series
Tags
cisa-kevpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-28/cisco-php2shell-expressway-urwb-duo-access-gateway-fixes · ATT&CK page ↗

Entries about Cisco Expressway Select Series (1)

2026-10-28 · view entry permalink →

NOTABLECVE-2026-109618 +1exploitedNATOA2

CVE-2026-109618 / CVE-2026-109619, Cisco Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder: Cisco's final PHP2Shell advisory names Expressway 15.5.21 and Duo Access Gateway 3.2.0 as the fixes and knows of no malicious use against its products

Cisco's advisory cisco-sa-php-october26-Jj384Daq, published on 2026-10-21 and final at version 1.8 on 2026-10-27, lists Expressway, Ultra-Reliable Wireless Backhaul, Duo Access Gateway and ISE Portal Builder as affected by CVE-2026-109618 and CVE-2026-109619, the PHP flaws behind PHP2Shell (Cisco PSIRT, 2026-10-27). Expressway Series and Expressway Select Series (bug CSCwx37062) have fixed release 15.5.21 and a workaround described in the bug record; Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software (bug CSCwx37073) have 27.1.1, listed for March 2027, and a workaround, and there the attacker must be authenticated as an administrator, which lowers the CVSS 3.1 score to 6.6; Duo Access Gateway is fixed in 3.2.0; and ISE Portal Builder is offline for remediation (Cisco PSIRT, 2026-10-27). The advisory gives no affected-version ranges and no workaround steps; its bug records carry platform-specific information, workarounds and fixed releases, and a product it does not list is, in Cisco's review, not affected (Cisco PSIRT, 2026-10-27).

Cisco says it is aware that a public announcement is available and knows of no malicious use of the flaws against any Cisco product (Cisco PSIRT, 2026-10-27); CISA added both flaws to its Known Exploited Vulnerabilities catalog on 2026-10-26 (CISA KEV, 2026-10-27). For Expressway the PHP fix is 15.5.21 (Cisco PSIRT, 2026-10-27), while the release Cisco names for the unauthenticated root command execution on clustered units, CVE-2026-76466, is X15.5.20 (Cisco PSIRT, 2026-10-21).

The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product.

If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.

For this product, the attacker must be authenticated as an administrator to exploit this vulnerability.

Cisco PSIRT (cisco-sa-php-october26-Jj384Daq, version 1.8) 2026-10-27

Builds on: PHP2Shell: CISA lists both flaws as exploited after honeypot code execution; update the… · Cisco: unauthenticated root RCE on clustered Expressway, fixed only in X15.5.20; X14 and… · Palo Alto reports active exploitation of PAN-OS management interfaces via PHP2Shell; 14… · NetScaler's PHP2Shell fix is out: 14.1-73.49, 13.1-64.32 and FIPS builds; restrict management… · PHP2Shell hits QNAP NAS before login: QTS, QuTS hero, QVR and TVR OS fixed, Notes Station 3 and… · PHP2Shell hits NetModule routers with no fix, macmon, Schneider, B&R, HMS, Wibu and Oracle… · HPE ClearPass through 6.14.1 and 6.11.16 is affected by PHP2Shell; hotfix patches exist for… · Eight eMudhra CA keys were guessable; Java needs a second update, and Python, Go, Rust and curl… · Camping.Care booking data stolen: TCS and a second campsite warn of WhatsApp fraud; PHP link…

vulnerability28 Oct 03:50Zsingle-sourceOpen finding →
Sources: Cisco PSIRT (cisco-sa-php-october26-Jj384Daq, version 1.8) · Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability) · CISA Known Exploited Vulnerabilities catalog (version 2026.10.27) · CISA (alert, Critical Vulnerabilities in PHP Require Immediate Patching)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov2 (50%)
  • sec.cloudapps.cisco.com2 (50%)
All cited sources (4)