EUVD-2026-107382
GHSA-p2jr-qv63-hjch
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Expressway database service over network
-
DeliveryPresent static persistent cookies
-
ExploitBypass ineffective TLS cert validation
-
ExecutionInvoke malicious RPC commands
-
ImpactExecute arbitrary commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Cisco Expressway (Expressway-C or Expressway-E) database service and use of the static/persistent cookies described in the advisory; the client-certificate validation that should restrict access is not performed even when the clustering TLS Verify Mode is set to Enabled, so that control provides no protection. The practical limiting factor is network exposure of the database/clustering service: environments that tightly restrict access to the clustering and database ports (e.g., only trusted management segments) reduce reachable attack surface, whereas DMZ-deployed Expressway-E nodes increase it. No authentication, no user interaction, and no non-default feature toggle is required to reach root per the CVSS PR:N/UI:N vector. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-risk inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is internally consistent with the description: a remote, unauthenticated attacker with network reachability to an Expressway device can achieve root command execution, yielding C:H/I:H/A:H for a 9.8 Critical score. The root cause (CWE-798, use of static/persistent cookies combined with insufficient client-certificate validation when TLS Verify Mode is Enabled for clustering) means the 'secret' required to connect to the database service is effectively static and not attacker-specific, which justifies the PR:N rating despite the description's phrase 'with possession of the cookies.' No EPSS score, CISA KEV entry, or public POC was provided in the input, so exploitation-probability and in-the-wild signals cannot be confirmed from the data given - this is a key missing signal. The absence of KEV/EPSS does NOT lower the intrinsic severity: static-credential bugs in internet-facing Cisco collaboration edge devices (Expressway-E often sits in the DMZ) are historically attractive targets. Treat as urgent-patch priority based on CVSS, attack vector, root-level impact, and the exposed nature of the product, while acknowledging that real-world exploitation volume is currently unknown from the provided intelligence. |
| Exploit ScenarioDerived | A remote attacker with network access to a Cisco Expressway-C or Expressway-E device (potentially from an untrusted/DMZ-facing network) connects to the exposed database service using the static persistent cookies, bypassing client-certificate validation that is silently ineffective even when TLS Verify Mode is Enabled for clustering. The attacker then invokes specific RPC commands against the database service to execute arbitrary operating-system commands as root. No public exploit identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deployments that expose the database service. The flaw combines reusable persistent cookies with a failure to validate client certificates when clustering TLS Verify Mode is set to Enabled, so an attacker in possession of the cookies can connect to the database service and invoke RPC commands to run arbitrary OS commands as root. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); no public exploit code was identified at time of analysis, and exploitation requires network reachability to the database and clustering service.
RemediationAI
Apply the fixed release identified in Cisco advisory cisco-sa-vcs-static-cred-hr7EWZ8t; the supplied data does not include an exact fixed version number, so verify the applicable Expressway-C and Expressway-E release in the advisory before upgrading. Because TLS Verify Mode Enabled does not validate client certificates in this scenario, do not treat clustering TLS verification as a mitigation. As compensating controls, restrict network access to the database and clustering service ports so only trusted cluster peers and management networks can reach them, and avoid exposing those interfaces on DMZ-facing Expressway-E nodes; this reduces reachable attack surface but can break legitimate clustering if peer access is not scoped correctly. Where clustering is not required, disabling it removes the database-service exposure at the cost of reduced redundancy and edge functionality. Monitor database-service RPC connections for unexpected sources and rotate or invalidate any persistent cookies only if the vendor provides a supported procedure, since unsupported changes may disrupt clustering.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Cisco Expressway Series database service uses persistent cookies as authentication material for cluster RPC operations. CWE-798 (Use of Hard-coded Credentials) describes the root cause: reusable credentials or tokens are embedded in the product's authentication design rather than being unique per deployment or securely negotiated. Compounding this, when clustering TLS Verify Mode is set to Enabled, the device does not perform sufficient validation of client certificates, so the mutual-TLS-style trust intended to restrict database-service access is ineffective. An attacker with the cookies and network access to the database service can invoke specific RPC methods and achieve root command execution on the underlying operating system. The affected CPE identifies Cisco Telepresence Video Communication Server (VCS) Expressway; the CVSS vector shows network access, low attack complexity, no privileges, and no user interaction, with high impact across confidentiality, integrity, and availability.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Static cookies and broken cert validation make the secret effectively non-attacker-specific, so PR:N and AC:L; network-reachable database service yields AV:N and root execution gives C:H/I:H/A:H.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root.
This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Executive ViewAI
Cisco Expressway-C and Expressway-E - the gateways that broker external access to our collaboration and unified communications services - carry a critical, unauthenticated root-level remote command execution flaw (CVE-2026-76466, CVSS 9.8) affecting deployments that expose the database service. Any network-reachable attacker could gain full administrative control of these internet-facing edge appliances, putting communications traffic, credentials traversing the edge, and the trust relationships between our Expressway cluster and internal systems at risk. Because no vendor patch is currently available and these devices typically sit on the perimeter, leadership should treat this as a priority exposure decision rather than a routine patch-cycle item.
No vendor-released patch is available, so isolate the exposure: restrict network reachability to the Expressway database and clustering services to trusted cluster peers only via firewall rules and host ACLs, ensure no database service is reachable from untrusted networks or the internet, consider disabling Clustering TLS Verify Mode only if Cisco confirms it reduces exposure without breaking cluster operation, rotate persistent cookies and cluster credentials, and enable monitoring and alerting for anomalous database-service connections and RPC activity until a patch is obtained from Cisco.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB