Cisco Expressway Series Vulnerabilities Disclosed: RCE and Information Disclosure
Article Content
- •Critical RCE vulnerability allows root command execution via persistent cookies.
- •Information disclosure flaw enables unauthorized access to sensitive data.
- •Cisco has released patches; no known active exploitation reported.
On October 21, 2026, Cisco disclosed multiple vulnerabilities affecting the Cisco Expressway Series, including a critical remote code execution (RCE) vulnerability and an information disclosure vulnerability. The RCE vulnerability allows unauthenticated attackers to execute arbitrary commands as root due to persistent cookies and insufficient validation of client certificates. The information disclosure vulnerability enables attackers to access sensitive information through crafted HTTP requests. Cisco has released software updates to address these vulnerabilities, which affect both Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) devices. No workarounds are available, and the vulnerabilities were not known to be actively exploited at the time of disclosure. The vulnerabilities are grouped under CVE identifiers for easier patching. Cisco advises all users to apply the updates promptly.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track Cisco and CVE-2026-76490 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which Cisco devices are affected?
What is the nature of the RCE vulnerability?
How urgent is the patching process?
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
Silent Lynx Targets CIS Governments via WinRAR Exploit The threat actor Silent Lynx has launched a series of attacks against government organizations in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks exploit a vulnerability in WinRAR (CVE-2025-8088) to deploy reverse shells, including FoalShell and PickleShell, facilitating…