Critical Vulnerability in Cisco Expressway Allows Remote Command Execution

## Overview A critical vulnerability, CVE-2026-76466, affects Cisco TelePresence Video Communication Server (VCS) Expressway. This flaw allows unauthenticated remote attackers to execute arbitrary operating system commands as root. The vulnerability stems from the use of persistent cookies and insufficient validation of client certificates in TLS Verify Mode when clustering. ## Technical Details The issue arises when an attacker possesses persistent cookies and connects to the database service of a Cisco Expressway device. The attacker can invoke specific remote procedure call (RPC) commands due to the lack of proper validation for client certificates. This vulnerability affects both Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices. The CVSS score for this vulnerability is 9.8, indicating a high severity level. ## Impact Successful exploitation of CVE-2026-76466 allows attackers to execute arbitrary commands on the underlying operating system of affected devices. This can lead to complete system compromise, data exfiltration, and further network infiltration. Organizations using Cisco Expressway devices should prioritize addressing this vulnerability to prevent potential breaches. ## Mitigation Defenders should immediately update Cisco Expressway devices to the latest firmware version that addresses this vulnerability. Additionally, organizations should review their network access controls and limit exposure to the database service. Implementing strict validation for client certificates in TLS configurations is also recommended to enhance security. Regular monitoring and auditing of systems can help detect any unauthorized access attempts.