CVE-2026-76466, Cisco Expressway-C and Expressway-E: unauthenticated root command execution on clustered devices, fixed in X15.5.20 with no workaround (CVSS 9.8), alongside same-day hardening releases for Unified CM, Unity Connection and Snort 3

Cisco's advisory of 2026-10-21 fixes CVE-2026-76466 (CVSS 3.1 9.8, network, no privileges, no user interaction) in the database service of Expressway-C and Expressway-E, virtual and appliance: an unauthenticated remote attacker with network access can run operating-system commands as root (Cisco PSIRT, 2026-10-21). The cause is the use of persistent cookies together with insufficient validation of client certificates for clustering, even when TLS Verify Mode is enabled; an attacker who possesses the cookies connects to the database service and invokes remote procedure call commands, and Cisco does not say how an attacker obtains the cookies (Cisco PSIRT, 2026-10-21). Only devices configured in a cluster are affected; X15.5.3 and earlier are fixed in X15.5.20, X14 and earlier must migrate to a fixed release, there is no workaround, and Cisco's PSIRT is not aware of any public announcement or malicious use (Cisco PSIRT, 2026-10-21). The X15.5.20 release also carries Expressway's own hardening fixes, whose worst class scores 8.6 (Cisco PSIRT, 2026-10-21).

The same day Cisco ships two further hardening releases whose worst classes are exploitable over the network without authentication. For Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of device configuration, the worst classes score 9.8 (CVE-2026-76473, improper control of a resource through its lifetime, and CVE-2026-76474, improper authentication); release 15 is fixed in 15SU5 and release 14 must migrate (Cisco PSIRT, 2026-10-21). For Snort 3 in Secure Firewall Threat Defense, Cyber Vision, Unified Threat Defense (UTD) on IOS XE and other Snort-based products, the worst classes score 9.0 with high attack complexity (CVE-2026-20043, an out-of-bounds write, and CVE-2026-20236, an incorrect calculation); FTD is fixed in 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0, Snort in 3.12.4.0, Cyber Vision in 5.6.0 and UTD on IOS XE in 17.12.8, 17.15.6, 17.18.5, 26.1.2 and 26.2.1, while Meraki MX devices that are online and connected to the Dashboard and Cisco's cloud firewall services were updated automatically on 2026-10-21 (Cisco PSIRT, 2026-10-21). Cisco says the flaws were found during internal security testing using existing processes as well as frontier AI models, and are not known to be actively exploited (Cisco PSIRT, 2026-10-21; Cisco PSIRT, 2026-10-21).