lee1981 (@lee1981b) on X

What it is

CVE-2026-76466 is a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E, virtual and appliance. Cisco's advisory is cisco-sa-vcs-static-cred-hr7EWZ8t (version 1.0, published 21 October 2026, 16:00 UTC), tracked as bug CSCww27732. Stefan Aleksic of Jane Street is credited. The weakness is CWE-798 (hard-coded credentials). Cisco CNA scored it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How it works

The clustering database service has persistent cookies and does not properly validate client certificates, even when TLS Verify Mode is Enabled. An attacker who holds the cookies and can reach the service can invoke specific RPC commands and run arbitrary OS commands as root. The page says how an attacker would obtain the cookies is unverified. It also gives no database port, RPC names or event signature.

Preconditions / Affected

All three must hold:

• The Expressway-C or Expressway-E is in a cluster.
• The attacker has network access to the database service.
• The attacker holds the persistent cookies.

The "no privileges" vector does not remove the cookie requirement. An Internet-facing web portal does not by itself establish the access path. Scope includes current and former cluster members, since removing a peer does not clear its earlier exposure.

What to do

• Fix: X15.5.3 and earlier: upgrade to X15.5.20, the first fixed release. X14 and earlier: migrate to a fixed release. Do not assume unlisted intermediate builds are fixed; ask Cisco TAC about unlisted builds or migration paths.
• Workaround: Cisco states none exists. Restricting database reachability through the network owner reduces opportunity but is not a fix. TLS Verify Mode, a password change or an ACL alone does not replace the patch.
• Inventory: Record each peer's role, release and cluster membership (Overview/Upgrade and System > Clustering). A central view may hide per-peer versions.
• Evidence: Collect per-peer logs, syslog and diagnostic exports before upgrading. Diagnostic-log download covers only the current peer. Starting or stopping logging or tcpdump can affect all peers.
• Upgrade order: The X15.5 maintenance guide recommends the Expressway-E cluster before Expressway-C, configuration primary first, then subordinates one at a time. Uploading an image is not installing it.
• Acceptance: Confirm the running fixed version on every peer and an Active database state in System > Clustering. Active shows health, not absence of earlier compromise.

Caveats

• Cisco PSIRT reported no awareness of public announcements or malicious use. Neither the page nor Cisco verified a public exploit or any IOC set.
• CISA SSVC (21 October 2026, 16:48 UTC) rated exploitation none, automatable yes, technical impact total.
• The KEV snapshot predates the advisory and has no match. FIRST returned no EPSS data, which means unavailable, not zero.
• NVD is Awaiting Analysis, and the v3.1 score comes from the CNA, not NIST. No CVSS v4.0 score is published.
• The root capability is Cisco's published claim. The author did not reproduce it or access an appliance.
• A network session to the database is not proof of command execution. Routine logs may omit database RPC or root commands, and absence of findings does not prove a clean system.