/
← Voltar ao feed
critical

Cisco patches critical unauthenticated root RCE (CVE-2026-76466) in Expressway Series database service

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 16 horas

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed a critical vulnerability, CVE-2026-76466, in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access could execute arbitrary operating system commands as root. The flaw stems from the use of persistent cookies and insufficient client certificate validation when TLS Verify Mode is enabled for clustering. Cisco has released software updates, and there are no workarounds. The article does not state that the flaw is exploited in the wild.

Detalhes técnicos

  • The database service uses persistent cookies. Client certificates are not validated when TLS Verify Mode is set to Enabled for clustering.
  • An attacker in possession of the cookies connects to the database service and invokes specific RPC commands. This yields command execution as root on the underlying OS.
  • Cisco rates the Security Impact as Critical. The advisory ID is cisco-sa-vcs-static-cred-hr7EWZ8t.
  • The advisory is part of Cisco's October 21, 2026 security advisory publication group.

Remediação

  • Apply the Cisco software updates that fix the vulnerability. No workarounds exist.
  • Review the Cisco Expressway Series Security Hardening Release: October 2026 for related fixes and improvements.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:00 primeiro registro só resumo do feed

    Cisco patches critical unauthenticated root RCE (CVE-2026-76466) in Expressway Series database service

    ler a análise desta fonte

    Cisco disclosed a critical vulnerability, CVE-2026-76466, in the database service of Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated remote attacker with network access could execute arbitrary operating system commands as root. The flaw stems from the use of persistent cookies and insufficient client certificate validation when TLS Verify Mode is enabled for clustering. Cisco has released software updates, and there are no workarounds. The article does not state that the flaw is exploited in the wild.

    Technical Details

    • The database service uses persistent cookies. Client certificates are not validated when TLS Verify Mode is set to Enabled for clustering.
    • An attacker in possession of the cookies connects to the database service and invokes specific RPC commands. This yields command execution as root on the underlying OS.
    • Cisco rates the Security Impact as Critical. The advisory ID is cisco-sa-vcs-static-cred-hr7EWZ8t.
    • The advisory is part of Cisco's October 21, 2026 security advisory publication group.

    Remediation

    • Apply the Cisco software updates that fix the vulnerability. No workarounds exist.
    • Review the Cisco Expressway Series Security Hardening Release: October 2026 for related fixes and improvements.