PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability CVE-2026-76466 with CVSS 9.8
A public proof-of-concept exploit has been released for CVE-2026-76466, a critical remote code execution vulnerability in Cisco Expressway cluster-manager module. The flaw stems from hard-coded credentials and a default permissive TLS mode that allows unauthenticated attackers who know the shared Erlang cookie and identity to execute commands as root remotely on clustered Expressway nodes. The vulnerability affects both Expressway-C and Expressway-E, virtual and physical, in clustered deployments. Cisco rated the flaw with a CVSS score of 9.8 and recommends patching to fixed releases (X15.5.20 or later for affected branches). No workaround exists, but restricting TCP ports 4371 and 4372 to authorized peers and monitoring for anomalous connections can help mitigate risk prior to patching. The proof-of-concept released by researcher Nicolas Krassas on GitHub includes exploit and detection capabilities, increasing the urgency to patch existing systems to prevent exploitation.
Entenda a falha
A vulnerabilidade
CVE-2026-76466 (CVSS 9.8, CWE-798 hard-coded credentials) is in the cluster-manager module of Cisco Expressway-C and Expressway-E, physical and virtual, when deployed in a cluster. An unauthenticated attacker who can reach TCP port 4372 and knows the hard-coded identity and Erlang cookie can run commands as root. Per the articles, systems on X15.5.3 and earlier must upgrade to X15.5.20 or later, and X14 and earlier must migrate to a fixed release. Cisco says there is no workaround.
Como funciona
Each clustered node runs a cluster database service on Erlang/OTP and listens for Erlang distribution traffic over TLS on port 4372. Peers join the mesh by authenticating with a shared cookie. The cm_server component adds a hard-coded maintenance identity to the allowed-node set and installs a matching hard-coded cookie. In TLS Permissive mode, the factory default, the server does not validate client certificates, so any client presenting that identity and cookie completes the handshake. It can then invoke functions on the node remotely, and the node runs as root.
Por que é vulnerável
The root cause is hard-coded credentials: the maintenance identity (using the legacy TANDBERG prefix) and the cookie are compiled into the module, so they are identical on every installation of the affected release. This is made worse by the insecure default of TLS Permissive mode, which skips client certificate validation. The articles do not explain why it went unnoticed or what the fix changes in detail.
Onde está
The cm_server component of the cluster-manager module in clustered Expressway, which listens for Erlang distribution on TCP port 4372.
Como foi descoberta
The articles do not say how the flaw was found. Cisco published its advisory on October 21, 2026, and its PSIRT said it knew of no malicious exploitation at that time. Researcher Nicolas Krassas (dinosn) later published an analysis, an exploit and a detector on GitHub.
PoC pública
Nicolas Krassas published a working exploit and a fleet detector on GitHub. The script has probe, ping (authentication only, no commands) and uid modes, and a test showed commands running as root. It was validated only on Expressway-C X15.3.2 in a two-node cluster in TLS Permissive mode; TLS Enforcing, Expressway-E, X14 and the fixed X15.5.20 were not tested. With a public tool available, patching is urgent. Until then, restrict ports 4371 and 4372 to cluster peers and alert on connections from other addresses.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 09:16.
Linha do tempo
-
PoC Exploit Released for Critical Cisco Expressway RCE Vulnerability CVE-2026-76466 with CVSS 9.8
ler a análise desta fonte ocultar
A public proof-of-concept exploit has been released for CVE-2026-76466, a critical remote code execution vulnerability in Cisco Expressway cluster-manager module. The flaw stems from hard-coded credentials and a default permissive TLS mode that allows unauthenticated attackers who know the shared Erlang cookie and identity to execute commands as root remotely on clustered Expressway nodes. The vulnerability affects both Expressway-C and Expressway-E, virtual and physical, in clustered deployments. Cisco rated the flaw with a CVSS score of 9.8 and recommends patching to fixed releases (X15.5.20 or later for affected branches). No workaround exists, but restricting TCP ports 4371 and 4372 to authorized peers and monitoring for anomalous connections can help mitigate risk prior to patching. The proof-of-concept released by researcher Nicolas Krassas on GitHub includes exploit and detection capabilities, increasing the urgency to patch existing systems to prevent exploitation.