Cisco Expressway’s October security releases cover several different boundaries: access to a clustered database service, weaknesses across clustered and standalone systems, information exposed during provisioning, and PHP embedded in the product. A team can complete one of those checks and still have work left. Cisco’s PHP matrix has also moved on since the initial release, so an older copy of the product table is insufficient.

Cisco’s 21 October database-service advisory identifies CVE-2026-76466, rated critical at 9.8. The affected set is Expressway Core and Edge, known as Expressway-C and Expressway-E, running a vulnerable release in a cluster. Both virtual installations and physical appliances are included.

An attacker needs network access to the database service and possession of persistent cookies. Invoking particular remote procedure calls can then execute operating-system commands as root. Cisco also says client certificates are not validated when the clustering TLS Verify Mode is enabled. An enabled setting therefore does not demonstrate that this validation is actually enforced on an affected release. The unauthenticated classification must be read alongside the cookie-possession prerequisite.

The database table lists X15.5.20 as the first correction for its X15.5.3-and-earlier row. X14 and earlier must migrate to a fixed release. Cisco reports no workaround that resolves the vulnerability. Network restrictions may reduce exposure as part of an authorised response, but they do not replace the listed software correction or establish that earlier access did not occur.

The broader Expressway hardening advisory has a different configuration scope. It includes virtual and appliance Core…