Clustered Cisco Expressway servers can be taken over as root without a login. Upgrade to X15.5.20, then Unified CM

Cisco Expressway is the box that lets remote workers and outside callers reach a company’s Cisco phone and video system. On Wednesday Cisco fixed a flaw, rated 9.8 out of 10, that lets an attacker run commands as root on Expressway servers set up in a cluster.

The same batch includes a hardening release for Unified Communications Manager and its sister products, with its top bugs also rated 9.8. Cisco says none of these are being exploited.

Clustered Cisco Expressway servers can be taken over as root without a login until they run X15.5.20. There is no workaround.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Cisco fixes a root-level flaw in clustered Expressway servers

CVE-2026-76466 sits in the Expressway database service. Cisco says it comes from persistent cookies plus missing client-certificate checks when TLS Verify Mode is enabled for clustering. An attacker who has the cookies can connect to the database service, call specific RPC commands and run commands as root. It affects Expressway-C and Expressway-E, virtual and appliance, when they are clustered.

A separate Expressway hardening release groups eight more CVEs, up to 8.6, that apply to every configuration. Both are fixed in X15.5.20; X14 and earlier must move to a fixed release.

The Unified Communications hardening release covers Unified CM, IM and Presence, Session Management Edition, Unity Connection, Emergency Responder and Prime Collaboration Deployment. Its eight CVEs top out at 9.8 (CVE-2026-76473, CVE-2026-76474), and the fix is release 15SU5.

Expressway clusters and Unified CM 14 and 15 phone systems

Expressway-E normally sits in the DMZ and talks to the internet, so it is one of the few Cisco voice systems that outsiders can reach. Root on it gives an attacker a foothold between the internet and the internal call platform.

Cisco says the Expressway hardening bugs came from internal testing that included frontier AI models. It groups them by weakness type under one CVE each, so the advisories carry little detail; upgrade on the version number rather than waiting for a write-up.

Move Expressway to X15.5.20 and Unified CM to 15SU5

• Check the version on every Expressway-C and Expressway-E and whether it is part of a cluster; clustered systems on X15.5.3 or earlier go first.
• Upgrade Expressway to X15.5.20. Plan a migration for anything still on X14.
• Schedule Unified CM, Unity Connection and the other collaboration servers on release 14 or 15 for 15SU5.
• If your Cisco firewalls run Threat Defense, add the Snort 3 hardening release (critical, 9.0) to the same change list.

Details

• CVE-2026-76466: Expressway database service, CVSS 3.1 9.8, unauthenticated, root command execution; clustered Expressway-C/E only. Fixed in X15.5.20.
• Expressway hardening: CVE-2026-76490 to CVE-2026-76497, highest 8.6, all configurations. Fixed in X15.5.20.
• Unified Communications hardening: CVE-2026-76473 to CVE-2026-76481 (eight IDs), highest 9.8. Fixed in 15SU5; release 14 must migrate.
• Snort 3 hardening: CVE-2026-20043 and three more, highest 9.0, affecting Secure Firewall Threat Defense, Meraki MX and other Snort 3 products.
• Exploitation: none known to Cisco PSIRT as of October 21.

Hunt / verify

• Confirm which Expressway nodes have clustering and TLS Verify Mode enabled, and that the cluster ports are not reachable from outside the cluster peers.
• After upgrading, confirm each node reports X15.5.20 in the Expressway web interface before you close the change.

Source: Cisco advisory: Expressway RCE; CVE.org: CVE-2026-76466

Sources

• Cisco: Cisco Expressway Series Remote Code Execution Vulnerability
• Cisco: Cisco Expressway Series Security Hardening Release, October 2026
• Cisco: Cisco Unified Communications Products Security Hardening Release, October 2026
• Cisco: Multiple Cisco Products Snort 3 Security Hardening Release, October 2026
• Cisco: Advance Notification for October 21, 2026 Security Advisories
• CVE.org: CVE-2026-76466

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].