Cisco Patches 9.8-Rated Expressway Root Flaw

Cisco has fixed a critical flaw in its Expressway devices that could let an attacker with no login run any operating-system command as root. The bug, CVE-2026-76466, carries a CVSS base score of 9.8, according to Cisco’s advisory, first published at 17:00 BST on 21 October. There is no workaround: the only fix is new software.

The flaw is not a zero-day. Cisco says its product security team “is not aware of any public announcements or malicious use” of it. But the bug needs no login to exploit, and it is the most serious Expressway issue in a batch of fixes Cisco released on the same day.

Clustered Expressway devices are the ones at risk

The flaw sits in the database service of Cisco Expressway, which covers both the Expressway-C (core) and Expressway-E (edge) devices, physical and virtual. Cisco blames two weaknesses. The first is “the use of persistent cookies”. The second is that when TLS Verify Mode is set to Enabled for clustering, client certificates “are not validated”. An attacker holding the cookies could connect to the database service, call specific remote procedure call (RPC) commands and run commands as root, Cisco says. It classifies the flaw under CWE-798.

Only devices “configured in a cluster” and running a vulnerable release are affected. For release X15.5.3 and earlier, the fix is X15.5.20. For X14 and earlier, Cisco’s advice is “Migrate to a fixed release.” The flaw was reported by Stefan Aleksic of Jane Street, the advisory says.

Eight more Expressway CVEs came from Cisco’s own review, partly using AI

The same X15.5.20 release closes a second set of Expressway problems, which Cisco found itself. A separate “hardening” advisory, rated High, groups them into eight CVEs, one for each class of weakness, with a highest score of 8.6. These affect Expressway “regardless of device configuration”, not only clusters. Cisco says they “were found during internal security testing using existing testing processes as well as frontier AI models”, and that none is known to be exploited.

Across all its products, Cisco patched 34 vulnerabilities on Wednesday, SecurityWeek reports. By its count, Expressway received 10 fixes. Unified Communications products received nine CVEs, including three critical ones (CVE-2026-76473, -76474 and -76475), and Snort 3 received 13, including the critical CVE-2026-20236 and CVE-2026-20043, fixed in Snort 3 version 3.12.4.0. The batch also covers a high-severity denial-of-service bug in IOS XR (CVE-2026-76505) and a high-severity privilege-escalation bug in Secure Client’s posture module (CVE-2026-76462). SecurityWeek says Cisco is not aware of any of them being exploited.

No workaround leaves patching as the only defence

Three details in Cisco’s advisory decide how urgent this is for any given network. The score is near the top of the scale, the attacker needs no account, and Cisco offers no workaround. Together, those leave administrators with one real option, which is to upgrade. The condition that limits the risk is clustering. Teams that run Expressway as a single box are outside this CVE, though not outside the eight hardening CVEs, which apply to every configuration.

The cookie requirement is the open question. Cisco says an attacker would need to possess the cookies, but does not say how hard they are to obtain. That gap is a reason to patch, not a reason to wait: the advisory gives defenders no way to measure the risk themselves. Customers on X14 or older face the most work, since Cisco offers them no patch on their current line, only a migration.

The disclosure also differs from Cisco’s last critical case covered by TSN. In mid-October, attackers were already using a Secure Email Gateway zero-day before a fix existed. This time the fix arrived with no reported exploitation, which gives defenders a head start. It lands in a heavy month for patches: Oracle shipped 1,295 fixes in its October update, SAP fixed a maximum-severity flaw on its patch day, and Node.js closed four high-severity bugs.

Cisco’s own wording on AI is worth noting. Saying that frontier models helped find some of the eight hardening bugs is a public sign that a major vendor is now using frontier AI models to hunt for bugs in its own products. Whether that speeds up disclosure across Cisco’s range will show in its next bundled release. The immediate test is simpler: whether “not aware of any malicious use” still holds once researchers start studying X15.5.20.