CISCO has issued three security advisories on 21 October 2026 addressing ten vulnerabilities across Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) gateways, with the most severe being a root remote code execution flaw.
The standout CVE is CVE-2026-76466, rated 9.8 (CVSSv3), described as allowing unauthenticated attackers possessing persistent cookies to connect to the database service and execute arbitrary operating system commands as root via specific RPC commands when clustering and TLS Verify Mode configurations are present. The advisory notes insufficient validation of client certificates in those conditions.
In addition, CVE-2026-76435 (CVSS 5.3) arises from insufficient authorization checks of HTTP requests during Mobile and Remote Access provisioning, enabling unauthenticated actors to read data by crafting URL requests.
A later October 2026 hardening release fixes eight CVEs (CVE-2026-76490 through CVE-2026-76497) with CVSS values up to 8.6, addressing issues such as out-of-bounds writes, null pointer dereferences, code injection and other exploitable conditions discovered during internal testing and with frontier AI models.
Cisco indicates these flaws affect both Expressway-C and Expressway-E in releases X14 and earlier, including X15.5.3 and earlier, and X15.5.2 (for the 76435 case). The patches require upgrading to X15.5.3 to remediate CVE-2026-76435 and to X15.5.20 to address CVE-2026-76466 along with the eight hardening CVEs. There are no workarounds published, and at the time of the advisories there was no confirmed public exploit or active exploitation in the wild.