Cisco o'zining Expressway Series tizimidagi jiddiy zaiflikni bartaraf etish uchun xavfsizlik yangilanishlarini e'lon qildi. CVE-2026-76466 sifatida kuzatiladigan bu zaiflik autentifikatsiyadan o'tmagan masofaviy hujumchilarga operatsion tizim buyruqlarini root huquqlari bilan ixtiyoriy ravishda bajarishga imkon berishi mumkin.
Uning CVSS v3.1 bazaviy bahosi 9.8 ni tashkil etadi va klasterda sozlangan zaif Expressway o'rnatmalariga ta'sir qiladi. Maslahat 2026-yil 21-oktabrda e'lon qilingan.
Zaiflik platformaning ma'lumotlar bazasi xizmati funksiyasiga ta'sir qiladi va doimiy cookie-fayllar hamda mijoz sertifikatlarining yetarli darajada tekshirilmasligi bilan bog'liq.
Ushbu muammoni muvaffaqiyatli ekspluatatsiya qilish uchun hujumchi ta'sirlangan qurilmaga tarmoq orqali kirish huquqiga ega bo'lishi va tegishli cookie-fayllarga ega bo'lishi kerak. Ushbu shartlar potentsial ta'sirni baholashda muhim ahamiyatga ega.
Cisco ma'lumotiga ko'ra, ushbu cookie-fayllarni qo'lga kiritgan hujumchi ma'lumotlar bazasi xizmatiga ulanishi va maxsus masofaviy protsedura chaqiruv (RPC) buyruqlarini bajarishi mumkin.
Bu asosiy operatsion tizimda root sifatida ixtiyoriy buyruqlarni bajarishga olib kelishi mumkin, bu esa hujumchiga ta'sirlangan qurilma ustidan yuqori darajadagi nazoratni beradi.
Maslahat shuningdek, klaster xavfsizlik sozlamalaridagi kamchilikni ham qayd etadi: TLS Verify Mode "Enabled" (Yoqilgan) qilib o'rnatilganda mijoz sertifikatlari tekshirilmaydi.
Natijada, ushbu sozlamani yoqish ta'sirlangan funksionallik uchun kutilgan sertifikat tekshiruvini ta'minlamaydi. Cisco zaiflikni doimiy cookie-fayllar bilan bog'liq muammolar bilan bog'laydi va uni CWE-798 toifasiga kiritadi.
Cisco hujumni autentifikatsiyadan o'tmagan deb ta'riflagan bo'lsa-da, muvaffaqiyatli ekspluatatsiya hali ham cookie-fayllarni qo'lga kiritishga bog'liq. Maslahat hujumchi ushbu cookie-fayllarni qanday qo'lga kiritishi mumkinligi yoki e'lon qilingan hujum vektorida cookie-fayllarni olishning aniq usulini aniqlamaydi.
Ushbu zaiflik Cisco Expressway Core (Expressway-C) va Cisco Expressway Edge (Expressway-E) ga ta'sir qiladi. Zaif dasturiy ta'minot ishlaydigan va klasterda sozlangan ham virtual, ham jismoniy qurilmalar ta'sirlanadi.
Maslahat har bir Expressway o'rnatmasini zaif deb tasniflamaydi; ushbu o'rnatish shartlari ta'sir doirasini belgilaydi.
Cisco muammoni ichki ravishda CSCww27732 sifatida kuzatadi va zaiflikni aniqlashda Stefan Aleksic (Jane Street) ga minnatdorchilik bildiradi.
Nashr etilgan vaqtda Cisco'ning Mahsulot Xavfsizligi Hodisalariga Javob Berish Jamoasi ushbu zaiflik bilan bog'liq hech qanday ommaviy e'lonlar yoki zararli ekspluatatsiyadan xabardor emasligini ma'lum qildi. Ushbu bayonot Cisco'ning xabardorligini aks ettiradi, ekspluatatsiya hech qachon sodir bo'lmaganligini isbotlamaydi.
Cisco X15.5.3 va undan oldingi versiyalar uchun X15.5.20 ni birinchi tuzatilgan versiya sifatida ko'rsatadi. X14 yoki undan oldingi versiyalarni ishlatayotgan mijozlar tuzatilgan versiyaga o'tishlari kerak.
Cisco ushbu zaiflik uchun hech qanday vaqtinchalik yechim yo'qligini ta'kidlaydi va ta'sirlangan tizimlarni yangilashni qat'iy tavsiya qiladi. Ushbu tuzatishlar Cisco'ning 2026-yil oktyabr oyidagi Expressway xavfsizlik mustahkamlash relizining bir qismidir.
Yangilashdan oldin mijozlar qurilmalarda yetarli xotira mavjudligini va mavjud apparat va dasturiy ta'minot sozlamalari hali ham qo'llab-quvvatlanishini tekshirishlari kerak. Cisco yangilash mosligi noaniq bo'lsa, Texnik Yordam Markazi yoki texnik xizmat ko'rsatuvchi provayderlar bilan bog'lanishni tavsiya qiladi.
Cisco has released security updates to address a critical vulnerability in its Expressway Series. This flaw, tracked as CVE-2026-76466, could allow unauthenticated remote attackers to execute arbitrary operating system commands with root privileges.
It has a CVSS v3.1 base score of 9.8 and affects vulnerable Expressway deployments configured in a cluster. The advisory was published on October 21, 2026.
The vulnerability affects the platform’s database service feature and involves persistent cookies and inadequate client certificate validation.
To successfully exploit this issue, an attacker must have network access to an affected device and possess the relevant cookies. These prerequisites are crucial when assessing potential exposure.
According to Cisco, an attacker who obtains these cookies could connect to the database service and execute specific remote procedure call (RPC) commands.
This could lead to arbitrary command execution as root on the underlying operating system, granting the attacker highly privileged control over the affected device.
The advisory also notes a failure in the clustering security configuration: client certificates are not validated when TLS Verify Mode is set to “Enabled.”
As a result, enabling this setting does not provide the expected certificate validation for the affected functionality. Cisco attributes the vulnerability to issues with persistent cookies and classifies it under CWE-798.
Even though Cisco describes the attack as unauthenticated, successful exploitation still relies on obtaining the cookies. The advisory does not specify how an attacker might acquire these cookies or identify a particular technique for cookie acquisition within the disclosed attack vector.
This vulnerability impacts both Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and physical appliances are affected when they run vulnerable software and are configured in a cluster.
The advisory does not classify every Expressway installation as vulnerable; these deployment conditions define the affected scope.
Cisco tracks the issue internally as CSCww27732 and credits Stefan Aleksic of Jane Street for reporting the vulnerability.
At the time of publication, Cisco’s Product Security Incident Response Team stated that it was unaware of any public announcements or malicious exploitation involving this flaw. This statement reflects Cisco’s awareness, not proof that exploitation has never occurred.
Cisco lists version X15.5.20 as the first fixed release for versions X15.5.3 and earlier. Customers running version X14 or earlier must migrate to a fixed release.
Cisco notes that no workarounds exist for this vulnerability and strongly recommends upgrading affected systems. These corrections are part of Cisco’s broader Expressway security hardening release for October 2026.
Before upgrading, customers should verify they have sufficient device memory and that existing hardware and software configurations remain supported. Cisco advises contacting its Technical Assistance Center or maintenance providers if upgrade compatibility is uncertain.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.