---
schema: 1
kind: vulnerability
title: "CVE-2026-76466, Cisco Expressway-C and Expressway-E: unauthenticated root command execution on clustered devices, fixed in X15.5.20 with no workaround (CVSS 9.8), alongside same-day hardening releases for Unified CM, Unity Connection and Snort 3"
headline: "Cisco: unauthenticated root RCE on clustered Expressway, fixed only in X15.5.20; X14 and earlier must migrate"
summary: >
  Cisco's disclosure of 2026-10-21 fixes CVE-2026-76466 (CVSS 3.1 9.8), which lets an unauthenticated attacker who holds
  persistent cookies run operating-system commands as root on Expressway-C and Expressway-E that are configured in a cluster;
  X15.5.3 and earlier get X15.5.20, X14 and earlier must migrate, and there is no workaround. Hardening releases ship the same
  day for the Unified CM family and Unity Connection (up to 9.8, fixed in 15SU5), and for Snort 3 in Secure Firewall Threat Defense
  and related products (9.0); Cisco knows of no malicious use of any of them.
discovered_at: "2026-10-22T03:43:00Z"
updated_at: null
event_date: "2026-10-21"
run_id: 2026-10-22T0256Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: []
entities: ["product:cisco-expressway-series", "product:cisco-unified-communications-manager", "product:cisco-unity-connection", "product:cisco-secure-firewall-threat-defense-ftd", "product:cisco-ios-xe"]
techniques: [T1190]
affected_products: ["Cisco Expressway Series", "Cisco Unified Communications Manager", "Cisco Unity Connection", "Cisco Secure Firewall Threat Defense (FTD)", "Cisco IOS XE Software"]
cves:
  - id: CVE-2026-76466
    cvss: "9.8 (CVSS 3.1)"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Expressway-C and Expressway-E, virtual and appliance, on X15.5.3 and earlier and on X14 and earlier, when configured in a cluster"
    fixed: "X15.5.20 (X14 and earlier: migrate to a fixed release)"
  - id: CVE-2026-76473
    cvss: "9.8 (CVSS 3.1, highest score of the worst underlying flaw in the CWE-74 class)"
    epss: null
    type: logic-flaw
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of device configuration, on release 15 before 15SU5 and on release 14"
    fixed: "15SU5 (release 14: migrate to a fixed release)"
  - id: CVE-2026-76474
    cvss: "9.8 (CVSS 3.1, highest score of the worst underlying flaw in the CWE-287 class)"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of device configuration, on release 15 before 15SU5 and on release 14"
    fixed: "15SU5 (release 14: migrate to a fixed release)"
  - id: CVE-2026-20043
    cvss: "9.0 (CVSS 3.1, highest score of the worst underlying flaw in the CWE-787 class; attack complexity high)"
    epss: null
    type: memory-corruption
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Secure Firewall Threat Defense (FTD) 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1 before the fixed builds, Open Source Snort 3 (3.x), Cyber Vision before 5.6.0 and Unified Threat Defense on IOS XE 17.12, 17.15, 17.18, 26.1 and 26.2 before the fixed releases, regardless of device configuration"
    fixed: "FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0; Snort 3.12.4.0; Cyber Vision 5.6.0; UTD on IOS XE 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1"
  - id: CVE-2026-20236
    cvss: "9.0 (CVSS 3.1, highest score of the worst underlying flaw in the CWE-682 class; attack complexity high)"
    epss: null
    type: logic-flaw
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Secure Firewall Threat Defense (FTD) 7.0 and earlier, 7.2, 7.4, 7.6, 7.7, 10.0 and 10.1 before the fixed builds, Open Source Snort 3 (3.x), Cyber Vision before 5.6.0 and Unified Threat Defense on IOS XE 17.12, 17.15, 17.18, 26.1 and 26.2 before the fixed releases, regardless of device configuration"
    fixed: "FTD 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2, 10.1.0; Snort 3.12.4.0; Cyber Vision 5.6.0; UTD on IOS XE 17.12.8, 17.15.6, 17.18.5, 26.1.2, 26.2.1"
sources:
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
    publisher: "Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability)"
    date: "2026-10-21"
    role: primary
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3"
    publisher: "Cisco PSIRT (cisco-sa-voice-hardening-twgbH9e3, Unified Communications Products Security Hardening Release)"
    date: "2026-10-21"
    role: primary
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe"
    publisher: "Cisco PSIRT (cisco-sa-hardening-snort3-ybgmhTQe, Snort 3 Security Hardening Release)"
    date: "2026-10-21"
    role: primary
  - url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs"
    publisher: "Cisco PSIRT (cisco-sa-exwy-hardening-FhcqBVcs, Expressway Series Security Hardening Release)"
    date: "2026-10-21"
    role: primary
closed_sources: []
evidence:
  - quote: "This vulnerability affects Cisco Expressway-C and Cisco Expressway-E, both virtual and appliance versions, if they are running a vulnerable release and have the devices configured in a cluster."
    publisher: "Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability)"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
  - quote: "there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering"
    publisher: "Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability)"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
  - quote: "There are no workarounds that address this vulnerability."
    publisher: "Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability)"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
  - quote: "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
    publisher: "Cisco PSIRT (cisco-sa-vcs-static-cred-hr7EWZ8t, Expressway Series Remote Code Execution Vulnerability)"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t"
  - quote: "These vulnerabilities were found during internal testing and are not known to be actively exploited."
    publisher: "Cisco PSIRT (cisco-sa-voice-hardening-twgbH9e3, Unified Communications Products Security Hardening Release)"
    source_url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3"
verification: single-source
sourcing_note: >
  Cisco's PSIRT is the first-party source for all four advisories; the hardening releases group internally found flaws under one
  CVE per weakness class, and each score is the maximum for the worst flaw in its class, not a rating of every flaw in it.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "On every Cisco Expressway-C and Expressway-E, upgrade to X15.5.20, clustered units first because only they carry the unauthenticated root flaw, and plan the migration of any unit still on X14 or earlier, which has no fix and no workaround."
updates: []
migrated_from: null
---

Cisco's advisory of 2026-10-21 fixes CVE-2026-76466 (CVSS 3.1 9.8, network, no privileges, no user interaction) in the database service of Expressway-C and Expressway-E, virtual and appliance: an unauthenticated remote attacker with network access can run operating-system commands as root ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)). The cause is the use of persistent cookies together with insufficient validation of client certificates for clustering, even when TLS Verify Mode is enabled; an attacker who possesses the cookies connects to the database service and invokes remote procedure call commands, and Cisco does not say how an attacker obtains the cookies ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)). Only devices configured in a cluster are affected; X15.5.3 and earlier are fixed in X15.5.20, X14 and earlier must migrate to a fixed release, there is no workaround, and Cisco's PSIRT is not aware of any public announcement or malicious use ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)). The X15.5.20 release also carries Expressway's own hardening fixes, whose worst class scores 8.6 ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs)).

The same day Cisco ships two further hardening releases whose worst classes are exploitable over the network without authentication. For Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of device configuration, the worst classes score 9.8 (CVE-2026-76473, improper control of a resource through its lifetime, and CVE-2026-76474, improper authentication); release 15 is fixed in 15SU5 and release 14 must migrate ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3)). For Snort 3 in Secure Firewall Threat Defense, Cyber Vision, Unified Threat Defense (UTD) on IOS XE and other Snort-based products, the worst classes score 9.0 with high attack complexity (CVE-2026-20043, an out-of-bounds write, and CVE-2026-20236, an incorrect calculation); FTD is fixed in 7.0.10, 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0, Snort in 3.12.4.0, Cyber Vision in 5.6.0 and UTD on IOS XE in 17.12.8, 17.15.6, 17.18.5, 26.1.2 and 26.2.1, while Meraki MX devices that are online and connected to the Dashboard and Cisco's cloud firewall services were updated automatically on 2026-10-21 ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe)). Cisco says the flaws were found during internal security testing using existing processes as well as frontier AI models, and are not known to be actively exploited ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3); [Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe)).

**Exposure:** Expressway-C and Expressway-E in a cluster on X15.5.3 or earlier, or on X14 or earlier; the affected component is the database service, and Cisco does not say on which network it listens, so an Expressway-E in a cluster is the case to check first ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)). A standalone Expressway is outside the vulnerable-product statement for CVE-2026-76466 ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)), but it still needs X15.5.20 for the hardening fixes, which Cisco lists for every Expressway-C and Expressway-E regardless of configuration ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs)).

**Detection:** connections to the database service from hosts that are not cluster peers, and new root-owned processes started by that service; Cisco publishes no flaw-specific indicator and states no exploitation, so no post-compromise check is defined ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t)).

**Defender takeaway:** upgrade Expressways to X15.5.20, clustered ones first, and schedule the move of X14 and earlier, Unified CM family and Unity Connection to 15SU5 (release 14 migrates), and FTD to the fixed build of its train; Cisco reports no exploitation of any of them and lists no workaround for the Expressway flaw ([Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t); [Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3); [Cisco PSIRT, 2026-10-21](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe)).