--- title: "Cisco Expressway 9.8 RCE and Unified CM Hardening Fixes" description: "Cisco October 2026 hardening releases fix CVE-2026-76466, an unauthenticated root RCE on clustered Expressway, plus two 9.8 flaws in Unified CM. Fixes, versions, and the evidence to keep." url: https://policycortex.com/blog/cisco-expressway-98-rce-unauthenticated-root sealed: 2026-10-23 register: blog/cisco-expressway-98-rce-unauthenticated-root records: 3 digest: sha3:9abc04ad4ea6e70aa153ca61ae86bb033fbf17a4034ed2531fb3c98b54b2b9a0 --- # Root Without a Login: Cisco Expressway and Unified CM Hardening Fixes Resources / Blog Cisco published October hardening releases on October 21, 2026. The worst flaw gives an unauthenticated remote attacker root on clustered Expressway. Two more 9.8 flaws hit Unified CM. No workarounds exist. Leonard Esere · Sealed 2026-10-23 · Reading time 6 min Filed under: [Cisco](https://policycortex.com/blog/tags/cisco), [Expressway](https://policycortex.com/blog/tags/expressway), [Unified CM](https://policycortex.com/blog/tags/unified-cm), [RCE](https://policycortex.com/blog/tags/rce), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [NIST 800-53](https://policycortex.com/blog/tags/nist-800-53), [news](https://policycortex.com/blog/tags/news) **Summary** - CVE-2026-76466 scores 9.8. An unauthenticated remote attacker can run OS commands as root on clustered Expressway-C and Expressway-E. - Fix Expressway in X15.5.20. Releases X14 and earlier must migrate. No workaround exists. - Unified CM hardening fixes eight CVEs, two scored 9.8, in release 15SU5. Release 14 must migrate. - Snort 3 hardening fixes four grouped CVEs topped by a 9.0 out-of-bounds write. Cisco found the bugs in internal testing with AI help. Some appliances sit in the DMZ (demilitarized zone) on purpose. Cisco Expressway-E is one of them. It lets remote staff reach internal voice and video without a VPN (virtual private network). On October 21, 2026, Cisco published hardening releases for that edge. The worst flaw needs no login at all. It gives an unauthenticated remote attacker root. ![Diagram of the attack path](https://policycortex.com/images/blog/cisco-expressway-98-rce-diagram.png) ## The Expressway flaw: root with no login The record is [CVE-2026-76466](https://www.cve.org/CVERecord?id=CVE-2026-76466). CVE (Common Vulnerabilities and Exposures) is the record system. The flaw sits in the database service of Cisco Expressway Series. It affects Expressway-C and Expressway-E in a cluster. Both virtual and appliance deployments are affected. The cause is twofold. The service uses persistent cookies. It also skips real client certificate checks when TLS (Transport Layer Security) Verify Mode is set to Enabled for clustering. An attacker with network access and the cookies can connect to the database service. The attacker invokes RPC (remote procedure call) commands. The result is arbitrary OS (operating system) commands as root. Cisco scores it 9.8 under CVSS (Common Vulnerability Scoring System) 3.1. The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain words: network reachable, low complexity, no privileges, no user interaction. The fix is X15.5.20. Releases X15.5.3 and earlier are affected. X14 and earlier must migrate to a fixed release. Cisco lists no workaround. Cisco PSIRT (Product Security Incident Response Team) knows of no public announcements or malicious use. That statement is dated October 21, 2026. ## Eight CVEs in Unified Communications A second advisory covers the voice products. The advisory id is cisco-sa-voice-hardening-twgbH9e3. It carries eight CVEs. Two score 9.8. [CVE-2026-76473](https://www.cve.org/CVERecord?id=CVE-2026-76473) is an injection class, CWE-74. [CVE-2026-76474](https://www.cve.org/CVERecord?id=CVE-2026-76474) is an improper authentication class, CWE-287. Both are network reachable without authentication. [CVE-2026-76475](https://www.cve.org/CVERecord?id=CVE-2026-76475) is a cross-site scripting (XSS) class at 9.3. [CVE-2026-76476](https://www.cve.org/CVERecord?id=CVE-2026-76476), [CVE-2026-76477](https://www.cve.org/CVERecord?id=CVE-2026-76477), and [CVE-2026-76478](https://www.cve.org/CVERecord?id=CVE-2026-76478) score 8.8. [CVE-2026-76479](https://www.cve.org/CVERecord?id=CVE-2026-76479) scores 7.8. [CVE-2026-76481](https://www.cve.org/CVERecord?id=CVE-2026-76481) scores 7.5. Cisco groups internally found bugs by weakness class. One CVE can cover several underlying issues. The score reflects the worst issue in each group. Affected products include Emergency Responder and Prime Collaboration Deployment. They also include Unified CM, Unified CM IM and Presence, Unified CM Session Management Edition, and Unity Connection. The fix is release 15SU5. Release 14 customers must migrate. No workaround exists. Cisco knows of no malicious use. ## Expressway hardening: eight grouped CVEs A companion advisory hardens Expressway itself. It carries [CVE-2026-76490](https://www.cve.org/CVERecord?id=CVE-2026-76490) through [CVE-2026-76497](https://www.cve.org/CVERecord?id=CVE-2026-76497). The highest score is 8.6 for an out-of-bounds write class. The rest cover denial of service and local flaws. The fix is X15.5.20. ## Snort 3 hardening: a 9.0 in the inspection engine A fourth advisory hardens Snort 3. Snort 3 is the inspection engine inside Cisco security products. It carries four grouped CVEs. [CVE-2026-20043](https://www.cve.org/CVERecord?id=CVE-2026-20043) is an out-of-bounds write scored 9.0. [CVE-2026-20236](https://www.cve.org/CVERecord?id=CVE-2026-20236) is an incorrect calculation class with a 9.0 worst-case score in the advisory. [CVE-2026-20291](https://www.cve.org/CVERecord?id=CVE-2026-20291) scores 7.8. [CVE-2026-20356](https://www.cve.org/CVERecord?id=CVE-2026-20356) scores 7.5. Affected products include open source Snort 3 and Secure Firewall Threat Defense. They also include Cyber Vision, UTD on IOS XE, Meraki MX, Cloud-delivered Firewall, and Secure Access. Fixes land in Snort 3.12.4.0 and Cyber Vision 5.6.0. Cisco says cloud firewall and Secure Access were updated automatically. Covered Meraki MX devices that were online were updated automatically. Self-managed installs need the upgrade. Cisco found these bugs in internal testing. The testing used existing processes plus frontier AI (artificial intelligence) models. ## The governance lesson: the edge appliance nobody inventories Voice and video appliances live outside the monitored boundary in many shops. The server team patches servers. The network team patches switches. The phone system belongs to neither. That is why this batch matters for governance. An assessor asks for a system inventory under CM-8. The inventory should list every Expressway and Unified CM node with its build number. If the phone system is missing, the inventory is wrong. An assessor asks for flaw remediation under SI-2. The proof is dated: the advisory date, the patch ticket, the before and after versions, the restart time. No workaround exists here, so the ticket should show the upgrade, not a config change. Continuous monitoring under CA-7 should cover these boxes too. A quarterly scan that skips the DMZ misses the exact box an attacker can reach first. PolicyCortex does not patch Cisco products. Your team applies vendor fixes. PolicyCortex helps organize the evidence that follows. ## What to do this week List every Expressway-C and Expressway-E. Note the version and whether it is clustered. Move clustered boxes on X15.5.3 or earlier to X15.5.20 first. List every Unified CM, Unity Connection, and related voice server. Note the release. Schedule 15SU5 for release 14 and 15 trains. Add Snort 3 to the same change list if you run Threat Defense or Cyber Vision. Keep the dated proof for each box. ## Sources - [CVE-2026-76466](https://www.cve.org/CVERecord?id=CVE-2026-76466) record, CVE Program. - Cisco Security Advisory cisco-sa-vcs-static-cred-hr7EWZ8t, Cisco Expressway Series Remote Code Execution Vulnerability, October 21, 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t - Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3, Cisco Unified Communications Products Security Hardening Release: October 2026, October 21, 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3 - Cisco Security Advisory cisco-sa-hardening-snort3-ybgmhTQe, Snort 3 Security Hardening Release: October 2026, October 21, 2026. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-snort3-ybgmhTQe - Original diagram by PolicyCortex. ## Next step Want patch evidence collected from your live systems? Book a [15-minute call](https://cal.com/leonardesere) to see how PolicyCortex does it. **Questions on this record** **Q: What is CVE-2026-76466?** A: A flaw in the database service of clustered Cisco Expressway. Persistent cookies plus weak TLS client certificate checks let an unauthenticated remote attacker invoke RPC commands and run OS commands as root. Fixed in X15.5.20. **Q: Which Unified CM versions are fixed?** A: Release 15SU5 carries the fixes for the eight hardening CVEs. Cisco directs release 14 customers to migrate to a fixed release. **Q: Is there a workaround?** A: No. Cisco lists no workarounds for these flaws. Patching is the only fix. **Q: Is any of this being exploited?** A: Cisco PSIRT says it knows of no public announcements or malicious use as of October 21, 2026. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-10-23 | [One Shared Atlassian Component Let Attackers Read Server Files With No Login](https://policycortex.com/blog/atlassian-data-center-file-read-kev): CVE-2026-21589 gives unauthenticated arbitrary file access in eight Atlassian Data Center products through one shared component. CISA added it to the KEV catalog on October 15, 2026. Public proof of concept code exists, and decoy servers saw attacks within about two hours of the advisory. | 6 min | | 2026-10-22 | [Arista VeloCloud Orchestrator Zero-Day: A Signed-In User Becomes Superuser](https://policycortex.com/blog/arista-vco-zero-day-superuser-escalation): Arista confirms active exploitation of the on-premises VeloCloud Orchestrator flaw. A signed-in user can reach superuser rights through SQL injection. | 5 min | | 2026-10-22 | [FortiSIEM RCE Needs No Login: Why Your Monitor Is the Target](https://policycortex.com/blog/fortisiem-unauthenticated-rce-monitor-target): CVE-2026-106173 gives an unauthenticated attacker code execution on FortiSIEM 7.5.0 through a gRPC service that skips client certificates. Fortinet shipped the fix on October 13, and a public exploit landed on October 20. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-10-23 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/cisco-expressway-98-rce-unauthenticated-root ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | 47175d0642e8 | 8ea3b104a5f6 | | REC 0001 | BODY | 2ee12ad963d5 | 47175d0642e8 | | REC 0002 | RELATED RECORDS | 9abc04ad4ea6 | 2ee12ad963d5 | Head sha3:9abc04ad4ea6e70aa153ca61ae86bb033fbf17a4034ed2531fb3c98b54b2b9a0. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.