[ CVE-2026-76466 · Published 21 Oct 2026 ]
Vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.8
[ Description ]Official description
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
NCSC-NLNCSC-2026-0451
Vulnerabilities fixed in Cisco Expressway Series Translated from Dutch
-
CERT-FRCERTFR-2026-AVI-1360
Multiple vulnerabilities in Cisco products Translated from French
Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-4105
Cisco Expressway: Multiple vulnerabilities Translated from German