CVE-2026-76466 — Cisco Expressway Cluster Database Root RCE

Summary

An unauthenticated remote attacker who can reach a clustered Cisco Expressway's Erlang distribution port (TCP/4372) can execute arbitrary operating-system commands as root by using a vendor-defined maintenance identity and its associated persistent cookie — both of which are hard-coded in the product's cluster-manager module (cm_server).

Field	Value
CVE	CVE-2026-76466
CVSS	9.8 Critical
CWE	CWE-798 (Use of Hard-coded Credentials)
Published	2026-10-21
Fixed in	X15.5.20
Workaround	None (per Cisco advisory)

Vulnerability Mechanism

Background

Cisco Expressway uses Erlang/OTP for its cluster database service. When two or more Expressway nodes are configured as a cluster, each node runs an Erlang distribution listener on TCP port 4372 protected by TLS. Erlang distribution sessions authenticate via a shared "cookie" — if an attacker knows the cookie and can reach the port, they can join the distribution mesh and invoke arbitrary function calls on the remote node, which runs as root.

The defect

The Expressway's cluster-manager module (cm_server) contains a function that admits a hard-coded maintenance node identity into the allowed-node set alongside the configured cluster peers. The identity uses the legacy TANDBERG prefix wombat@. A matching hard-coded cookie is installed at the same time. Because both values are baked into the compiled Erlang module, they are identical on every installation of the affected release.

In TLS Permissive mode (the factory default), the server does not validate client certificates, so any network client that knows the maintenance identity and cookie can complete the distribution handshake and execute RPC calls.

Attack chain

TLS 1.3 connect to target:4372
  → Erlang dist handshake with node name "[email protected]"
    → cm_server admits the identity (add_allowed_wombat_node)
      → challenge-response with cookie "wombat"
        → distribution session established (ping = pong)
          → rpc:call(Target, os, cmd, ["id -u"]) → 0

Affected Products

Per Cisco's advisory:

• Cisco Expressway-C (virtual and appliance), clustered, running a vulnerable release
• Cisco Expressway-E (virtual and appliance), clustered, running a vulnerable release
• X15.5.3 and earlier: upgrade to X15.5.20
• X14 and earlier: migrate to a fixed release

Detection

Use the included exploit/cve_2026_76466.py --mode ping to check whether a target admits the maintenance identity. This performs authentication only (no command execution).

For fleet-scale triage:

1. Inventory clustered Expressway-C/E devices
2. Check the software release against the affected list
3. Confirm TCP/4372 reachability from non-peer networks
4. Run the --mode ping check against each clustered node

Remediation

Cisco states there is no workaround. Upgrade is the remediation:

• X15.5.3 and earlier → upgrade to X15.5.20 or later
• X14 and earlier → migrate to a fixed release

Until upgrades complete, restrict TCP/4371–4372 to authorized cluster peers and alert on connections from non-peer addresses.

Tested Scope and Limitations

Runtime validation was performed on:

• Cisco Expressway-C X15.3.2, two-node cluster, TLS Permissive mode
• The bounded command id -u returned 0 (root)

Not tested:

• TLS Enforcing mode
• Expressway-E
• X14 releases
• X15.5.20 (fixed) as a negative control

Disclaimer

This tool is for authorized security testing only. The maintainer is not responsible for misuse. Always obtain written permission before testing any system you do not own.