PolicyCortex
Request Access
Summary
  • CVE-2026-76466 scores 9.8. An unauthenticated remote attacker can run OS commands as root on clustered Expressway-C and Expressway-E.
  • Fix Expressway in X15.5.20. Releases X14 and earlier must migrate. No workaround exists.
  • Unified CM hardening fixes eight CVEs, two scored 9.8, in release 15SU5. Release 14 must migrate.
  • Snort 3 hardening fixes four grouped CVEs topped by a 9.0 out-of-bounds write. Cisco found the bugs in internal testing with AI help.

Some appliances sit in the DMZ (demilitarized zone) on purpose. Cisco Expressway-E is one of them. It lets remote staff reach internal voice and video without a VPN (virtual private network).

On October 21, 2026, Cisco published hardening releases for that edge. The worst flaw needs no login at all. It gives an unauthenticated remote attacker root.

Diagram of the attack pathDiagram of the attack path

The Expressway flaw: root with no login

The record is CVE-2026-76466. CVE (Common Vulnerabilities and Exposures) is the record system.

The flaw sits in the database service of Cisco Expressway Series. It affects Expressway-C and Expressway-E in a cluster. Both virtual and appliance deployments are affected.

The cause is twofold. The service uses persistent cookies. It also skips real client certificate checks when TLS (Transport Layer Security) Verify Mode is set to Enabled for clustering.

An attacker with network access and the cookies can connect to the database service. The attacker invokes RPC (remote procedure call) commands. The result is arbitrary OS (operating system) commands as root.

Cisco scores it 9.8 under CVSS (Common Vulnerability Scoring System) 3.1. The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain words: network reachable, low complexity, no privileges, no user interaction.

The fix is X15.5.20. Releases X15.5.3 and earlier are affected. X14 and earlier must migrate to a fixed release. Cisco lists no workaround.

Cisco PSIRT (Product Security Incident Response Team) knows of no public announcements or malicious use. That statement is dated October 21, 2026.

Eight CVEs in Unified Communications

A second advisory covers the voice products. The advisory id is cisco-sa-voice-hardening-twgbH9e3.

It carries eight CVEs. Two score 9.8. CVE-2026-76473 is an injection class, CWE-74. CVE-2026-76474 is an improper authentication class, CWE-287. Both are network reachable without authentication.

CVE-2026-76475 is a cross-site scripting (XSS) class at 9.3. CVE-2026-76476, CVE-2026-76477, and CVE-2026-76478 score 8.8. CVE-2026-76479 scores 7.8. CVE-2026-76481 scores 7.5.

Cisco groups internally found bugs by weakness class. One CVE can cover several underlying issues. The score reflects the worst issue in each group.

Affected products include Emergency Responder and Prime Collaboration Deployment. They also include Unified CM, Unified CM IM and Presence, Unified CM Session Management Edition, and Unity Connection.

The fix is release 15SU5. Release 14 customers must migrate. No workaround exists. Cisco knows of no malicious use.

Expressway hardening: eight grouped CVEs

A companion advisory hardens Expressway itself. It carries CVE-2026-76490 through CVE-2026-76497.

The highest score is 8.6 for an out-of-bounds write class. The rest cover denial of service and local flaws. The fix is X15.5.20.

Snort 3 hardening: a 9.0 in the inspection engine

A fourth advisory hardens Snort 3. Snort 3 is the inspection engine inside Cisco security products.

It carries four grouped CVEs. CVE-2026-20043 is an out-of-bounds write scored 9.0. CVE-2026-20236 is an incorrect calculation class with a 9.0 worst-case score in the advisory. CVE-2026-20291 scores 7.8. CVE-2026-20356 scores 7.5.

Affected products include open source Snort 3 and Secure Firewall Threat Defense. They also include Cyber Vision, UTD on IOS XE, Meraki MX, Cloud-delivered Firewall, and Secure Access. Fixes land in Snort 3.12.4.0 and Cyber Vision 5.6.0.

Cisco says cloud firewall and Secure Access were updated automatically. Covered Meraki MX devices that were online were updated automatically. Self-managed installs need the upgrade.

Cisco found these bugs in internal testing. The testing used existing processes plus frontier AI (artificial intelligence) models.

The governance lesson: the edge appliance nobody inventories

Voice and video appliances live outside the monitored boundary in many shops. The server team patches servers. The network team patches switches. The phone system belongs to neither.

That is why this batch matters for governance. An assessor asks for a system inventory under CM-8. The inventory should list every Expressway and Unified CM node with its build number. If the phone system is missing, the inventory is wrong.

An assessor asks for flaw remediation under SI-2. The proof is dated: the advisory date, the patch ticket, the before and after versions, the restart time. No workaround exists here, so the ticket should show the upgrade, not a config change.

Continuous monitoring under CA-7 should cover these boxes too. A quarterly scan that skips the DMZ misses the exact box an attacker can reach first.

PolicyCortex does not patch Cisco products. Your team applies vendor fixes. PolicyCortex helps organize the evidence that follows.

What to do this week

List every Expressway-C and Expressway-E. Note the version and whether it is clustered. Move clustered boxes on X15.5.3 or earlier to X15.5.20 first.

List every Unified CM, Unity Connection, and related voice server. Note the release. Schedule 15SU5 for release 14 and 15 trains.

Add Snort 3 to the same change list if you run Threat Defense or Cyber Vision. Keep the dated proof for each box.

Sources

Next step

Want patch evidence collected from your live systems? Book a 15-minute call to see how PolicyCortex does it.

Questions on this record
What is CVE-2026-76466?
A flaw in the database service of clustered Cisco Expressway. Persistent cookies plus weak TLS client certificate checks let an unauthenticated remote attacker invoke RPC commands and run OS commands as root. Fixed in X15.5.20.
Which Unified CM versions are fixed?
Release 15SU5 carries the fixes for the eight hardening CVEs. Cisco directs release 14 customers to migrate to a fixed release.
Is there a workaround?
No. Cisco lists no workarounds for these flaws. Patching is the only fix.
Is any of this being exploited?
Cisco PSIRT says it knows of no public announcements or malicious use as of October 21, 2026.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. One Shared Atlassian Component Let Attackers Read Server Files With No LoginCVE-2026-21589 gives unauthenticated arbitrary file access in eight Atlassian Data Center products through one shared component. CISA added it to the KEV catalog on October 15, 2026. Public proof of concept code exists, and decoy servers saw attacks within about two hours of the advisory.6 min
  2. Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes SuperuserArista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection.5 min
  3. FortiSIEM RCE Needs No Login: Why Your Monitor Is the TargetCVE-2026-106173 gives an unauthenticated attacker code execution on FortiSIEM 7.5.0 through a gRPC service that skips client certificates. Fortinet shipped the fix on October 13, and a public exploit landed on October 20.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere