CVE-2026-76466

Summary

A critical authentication bypass in Cisco Expressway's database service allows unauthenticated remote attackers to execute arbitrary commands as root due to weak cookie-based persistence and missing client certificate validation during clustering.

Exploitability

Exploitation requires network access and possession of valid persistent cookies; no user interaction or prior authentication is needed.

Blast radius

Successful exploitation grants full system compromise (root-level RCE) on affected Expressway-C and Expressway-E devices, enabling full data exfiltration, lateral movement, or service disruption.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Cisco Expressway version 2.590 or later, as this is the fixed version that addresses the vulnerability in the database service.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.