Cisco Expressway: critical remote code execution (CVE-2026-76466) fixed in X15.5.20
CVE-2026-76435 CVE-2026-76466 CVE-2026-76490 CVE-2026-76491 CVE-2026-76492 CVE-2026-76493 CVE-2026-76494 CVE-2026-76495 CVE-2026-76496 CVE-2026-76497
Published 02/11/2026 02:15
Timeline
2 events over 11 d
- 21/10/2026 18:00ConfirmedCisco Security Advisories+11 d
- 02/11/2026 02:15Published on WatchtowerPro CISO
In short
Cisco fixed several flaws in Expressway-C and Expressway-E, including a critical remote code execution flaw (CVE-2026-76466) that lets an unauthenticated attacker with network access run commands as root on clustered units. Cisco, BSI CERT-Bund and NCSC-NL have published advisories. Cisco says the hardening flaws are not known to be exploited. Update to X15.5.20 or later.
How bad is it
Critical. An attacker with network access to a clustered Expressway can run commands on it as root, without logging in.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 10 CVEs · CVSS 3.1 from NVD, from cisco.com, read 02/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Remote code execution flaw: Expressway-C and Expressway-E, virtual and appliance, on X15.5.3 and earlier, only when configured in a cluster.
- Information disclosure flaw: Expressway on X15.5.2 and earlier, caused by insufficient authorization checks on HTTP requests during Mobile and Remote Access (MRA) provisioning.
- Hardening group of 8 CVEs: Expressway-C and Expressway-E, virtual and appliance, on X15.5.3 and earlier, regardless of configuration.
Fixed in
- Cisco lists Expressway X15.5.20 as the first fixed release for the remote code execution flaw and the hardening release.
What to do now
- Update every Expressway-C and Expressway-E to X15.5.20 or later; this covers all three advisories, and Cisco says the remote code execution fix is also part of the hardening release.
- Units on X14 or earlier have no fix; migrate them to X15.5.20 or later and plan that migration now.
- Upgrade clustered units first, and Expressway-E before Expressway-C.
- Cisco offers no workarounds. Until you have updated, limit network access to the cluster and database service to cluster peers only and review logs for unexpected access or root activity. These are general measures, not Cisco's. They reduce exposure but do not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer and all 9 sources with their dates. And technology matching: which of your systems run Cisco Expressway Series (Expressway-C and Expressway-E), at which version, fixed or not - and what each one needs.
Main sources
Cisco Expressway Series Remote Code Execution Vulnerability Vendor · Cisco Expressway Series Information Disclosure Vulnerability Vendor · Cisco Expressway Series Security Hardening Release: October 2026 Vendor