al-ice.ai

Persistent Cookies, Skipped Certificate Checks, Root: Cisco Patches an Unauthenticated Expressway Cluster RCE

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 21 October 2026 at 16:00 GMT, Cisco PSIRT published three Expressway Series advisories (all version 1.0, Final) under its 21 October advance notification. The headline is CVE-2026-76466 — a CVSS 9.8 unauthenticated remote-code-execution flaw that yields arbitrary operating-system commands as root on clustered Expressway-C and Expressway-E appliances. It is accompanied by an eight-CVE hardening batch that Cisco says was found using frontier AI models, and a smaller unauthenticated information-disclosure bug in Mobile and Remote Access provisioning. None of the three advisories offers a workaround. Upgrade is the only remediation in every case.

The critical one needs a cluster — and cookies

CVE-2026-76466 (Cisco bug CSCww27732, CWE-798, CVSS 3.1 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) sits in the database-service feature of Expressway Series. Cisco’s mechanism description has two halves that combine badly: the service relies on persistent cookies, and when TLS Verify Mode is set to Enabled for clustering, client certificates are not validated. An unauthenticated remote attacker with network access and possession of the cookies can connect to the database service, invoke specific RPC commands, and execute arbitrary commands as root on the underlying OS.

Scope is narrower than the score alone suggests, and the narrowness matters for triage: only Expressway-C and Expressway-E, virtual and appliance, configured in a cluster are vulnerable. Standalone deployments are not affected by this CVE. Fixed software is X15.5.20 (X14 and earlier must migrate to a fixed release). Cisco credits Stefan Aleksic of Jane Street with the report, and states it is not aware of any public announcements or malicious use of the vulnerability. The NVD 2.0 record, filed by psirt@cisco.com, was published at 17:19Z on 21 October — roughly eighty minutes after the advisory — and sits at status Awaiting Analysis, carrying the same 9.8 vector.

Eight CVEs that are really eight vulnerability classes

The second advisory (cisco-sa-exwy-hardening-FhcqBVcs) is the format Cisco now uses routinely — and one we covered two weeks ago for NX-OS: issues grouped by CWE, one CVE per class, each score representing the worst bug inside the bucket. The Expressway batch carries CVE-2026-76490 through CVE-2026-76497, four at 8.6 and four at 7.8:

  • CVE-2026-76490 — 8.6 — CWE-787, incorrect permission assignment for critical resources
  • CVE-2026-76491 — 8.6 — CWE-617, reachable assertions
  • CVE-2026-76492 — 8.6 — CWE-476, null pointer dereferences
  • CVE-2026-76493 — 8.6 — CWE-248, uncaught exceptions
  • CVE-2026-76494 — 7.8 — CWE-94, code injection
  • CVE-2026-76495 — 7.8 — CWE-732, incorrect permission assignment
  • CVE-2026-76496 — 7.8 — CWE-59, link following
  • CVE-2026-76497 — 7.8 — CWE-377, insecure temporary files

Two details deserve attention. First, the 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) is availability-heavy: no confidentiality or integrity impact, total availability loss, with scope changed. These read as remotely triggerable crashes in perimeter-facing services — denial of service against the box that carries your external calls. Second, Cisco repeats the sentence that is becoming a disclosure trend: “These vulnerabilities were found during internal security testing using existing testing processes as well as frontier AI models.” The same phrasing anchored the NX-OS batch on 7 October, and Fortinet’s 22 October hardening release credits AI-assisted testing with frontier-lab involvement too. Vendors are now routinely telling you that models are finding the bugs — which cuts both ways, because anything a lab model finds in a vendor’s internal review is findable by other models outside it. Unlike the cluster RCE, the hardening batch affects Expressway-C and Expressway-E regardless of configuration, and the fix is again X15.5.20. Cisco says these issues are not known to be actively exploited.

The quiet third advisory

CVE-2026-76435 (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) is an unauthenticated information disclosure in Mobile and Remote Access (MRA) provisioning: insufficient authorization checks on HTTP requests let an attacker submit a crafted URL and read data they should not reach. It was found during the resolution of a TAC support case, not a security review. The fix is X15.5.3 (X15.5.2 and earlier upgrade; X14 and earlier migrate). Low severity, but MRA is the externally reachable provisioning surface of Expressway-E — an unauthenticated read primitive on exactly the interface that faces the internet is worth patching in the same window, not deferring because of the number.

What to do

  • Upgrade clustered Expressway-C/E to X15.5.20 now. CVE-2026-76466 is unauthenticated, network-reachable root with no workaround. Expressway-E exists to sit at the network edge and terminate external sessions — treat a root RCE on it as perimeter-compromise severity even gated on clustering.
  • Do not skip X15.5.20 on standalone boxes either. The hardening batch applies regardless of configuration, and its 8.6s are unauthenticated remote availability kills. Patch standalone systems in the same change.
  • Take X15.5.3 at minimum for the MRA disclosure. If X15.5.20 is not immediately deployable in your environment, X15.5.3 closes the unauthenticated MRA read primitive — but note it does not cover the root RCE or the hardening batch, so treat it as a floor, not a destination.
  • Confirm cluster membership before you scope. The 9.8 affects only clustered deployments. Inventory which Expressway pairs are actually clustered versus standalone before declaring systems unaffected — the precondition is a configuration state, not a model number.
  • Watch, but do not invent, exploitation signal. Cisco reports no public announcements or malicious use for any of the three advisories, and no IOCs were published. That is a vendor statement as of 21 October, not a clean bill of health — monitor Expressway edge logs for anomalous database-service connections and unexpected processes, and reassess if PSIRT updates the exploitation language.

This write-up is our analysis of the three Cisco Expressway Series security advisories published 21 October 2026 at 16:00 GMT (cisco-sa-vcs-static-cred-hr7EWZ8t, cisco-sa-exwy-hardening-FhcqBVcs and cisco-sa-expressway-inf-disc-vvYqgSTS) and the NVD 2.0 record for CVE-2026-76466, all read first-hand. Scores, vectors, affected-version statements, the frontier-AI-models sentence and the exploitation-status language are Cisco’s, carried as vendor telemetry. The framing of Expressway-E as a perimeter asset and the both-ways reading of AI-assisted discovery are our analysis, not vendor statements. We did not test any of these vulnerabilities, write or obtain a proof of concept, or contact any Expressway deployment.

Sources: