Remote Code Execution Vulnerability in Cisco Expressway Series
CVE-2026-76466

9.8CRITICAL

Key Information:

Vendor

Cisco
Status
Cisco Telepresence Video Communication Server (vcs) Expressway
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-76466?

A vulnerability affecting the Cisco Expressway Series allows an unauthenticated remote attacker with network access to execute arbitrary operating system commands as root. This issue arises from the reliance on persistent cookies and insufficient validation of client certificates in certain configurations. When TLS Verify Mode is enabled for clustering, client certificates do not undergo proper validation, enabling an attacker with access to these cookies to exploit the database service by invoking remote procedure calls (RPC). Potential impacts include unauthorized execution of commands, leading to severe implications for the security of affected systems.

Affected Version(s)

Cisco TelePresence Video Communication Server (VCS) Expressway X8.11.2

Cisco TelePresence Video Communication Server (VCS) Expressway X8.6

Cisco TelePresence Video Communication Server (VCS) Expressway X8.11.3

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.