Systems Engineering Security Advisory — October 22, 2026
On Wednesday, October 21st, Cisco announced a critical security vulnerability affecting Cisco Expressway, a technology used to support video and collaboration services. Cisco has released software updates to address it. The Systems Engineering team has been tracking this announcement closely and is responding proactively for our clients- we are in direct communications with clients we believe will be impacted by this announcement and the associated patching required.
Why the urgency?
Tracked as CVE-2026-76466, the vulnerability carries a critical severity score of 9.8 out of 10. It could allow a remote attacker without valid login credentials, but with network access to the affected database service and possession of the required cookies, to gain full control of an affected system. It affects both virtual and appliance versions of Expressway-C and Expressway-E when configured in a cluster and running a vulnerable software release.
Prompt attention is important for two reasons:
- No workarounds exist. Upgrading is the only fix.
- Expressway-E devices commonly operate at the network edge. Organizations should prioritize reviewing internet-facing deployments and access to the affected service.
At the time of disclosure, Cisco reported no known malicious use of this vulnerability. That does not remove the need to promptly update affected systems.
What Should I do if I don’t currently partner with Systems Engineering?
For organizations managing their own Cisco Expressway systems: Ask your IT team or technology provider to review your deployment against Cisco’s advisory and prioritize the appropriate software updates. Review the broader hardening release as well, even if your systems are not clustered.
If you are not currently working with Systems Engineering and need assistance assessing your exposure or planning remediation, contact us to discuss how we can help.
