Cisco has released security updates for a critical Cisco Expressway vulnerability that could let remote attackers run operating system commands as root.

Tracked as CVE-2026-76466, the flaw carries a CVSS score of 9.8 and affects vulnerable Expressway devices configured in a cluster. Cisco published its advisory on October 21, 2026.

The issue affects Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E). Both virtual deployments and hardware appliances are affected when running vulnerable software with clustering enabled. Successful exploitation could give attackers control over the underlying operating system.

According to Cisco’s security advisory, the weakness sits in the database service and involves persistent cookies. Cisco also found that client certificates are not properly checked when clustering enables TLS Verify Mode. This means the enabled setting does not provide the expected certificate validation.

An attacker who has the required cookies and network access to an affected device could connect to its database service and invoke specific remote procedure call commands. These calls could allow the attacker to run commands with root privileges, the highest level of access on the system.

Cisco Expressway Vulnerability

Although Cisco describes the attacker as unauthenticated, possession of the cookies remains an important requirement. The advisory does not explain how an attacker would obtain them.

Readers should therefore avoid interpreting the finding as proof that an attacker can immediately compromise every reachable Expressway device.

The potential impact resembles other cases covered in Cyber Security News’ reporting on critical Cisco remote code execution flaws, though the affected products and attack methods differ.

Cisco lists Expressway X15.5.3 and earlier as affected, with X15.5.20 identified as the first fixed release. Customers using X14 or earlier must migrate to a fixed release. No workarounds address this vulnerability.

The fix is also included in Cisco’s broader October 2026 Expressway security hardening release. That release addresses additional weaknesses discovered during an internal security review.

Unlike this cluster-specific flaw, the broader hardening advisory covers affected Expressway-C and Expressway-E devices regardless of configuration. Administrators should check installed versions and cluster settings, then plan upgrades using Cisco’s compatibility guidance.

Checking the version alone does not establish exposure because this particular vulnerability also requires a clustered deployment. Broader coverage is available through Cyber Security News’ Cisco security updates.

Cisco credited Stefan Aleksic of Jane Street with reporting the vulnerability. At publication, its Product Security Incident Response Team said it was unaware of public announcements or malicious use. That statement does not reduce the need to patch affected clusters, given the potential for remote commands to run as root.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical Cisco Expressway Vulnerability Enables Remote Code Execution Attacks appeared first on Cyber Security News.

Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code with root privileges without logging in.

The flaws affect the Next Generation Operation, Administration, and Maintenance feature, known as NGOAM, in Cisco NX-OS Software. Successful attacks could also crash processes, force switches to reload, and disrupt network services.

Published on October 7, 2026, Cisco’s security advisory covers CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501. The advisory carries a CVSS base score of 9.8.

Cisco found the vulnerabilities during internal security testing and said its Product Security Incident Response Team was not aware of public announcements or malicious use when the advisory was released.

The flaws stem from improper validation of incoming IP traffic when NGOAM is enabled. An attacker can send crafted packets to an IP interface on an affected switch.

If exploitation succeeds, those packets could trigger code execution with root privileges, giving the attacker control at the operating system’s highest privilege level. The same attack path could cause a denial-of-service condition through process crashes and device reloads.

NGOAM supports network checks and troubleshooting. Its VXLAN functions help detect and address loops. In contrast, its Segment Routing over IPv6, or SRv6, functions help operators check connectivity and locate forwarding problems.

However, the exposure differs across the three vulnerabilities, so administrators must check both software versions and enabled features rather than treating every Nexus switch as affected.

Cisco Nexus Flaws

Cisco’s security advisory applies to Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode. CVE-2026-76485 requires only NGOAM to be enabled.

CVE-2026-76486 requires NGOAM alongside either SRv6 or a qualifying Network Virtualization Overlay configuration. For the overlay path, a VXLAN EVPN network identifier must be mapped to an NVE interface with at least one learned peer tunnel endpoint.

CVE-2026-76501 requires both NGOAM and SRv6. Nexus 3000 switches do not support SRv6, and only some Nexus 9000 models support it. Cisco confirmed that Nexus 9000 switches running in ACI mode, Nexus 7000 switches, and MDS 9000 multilayer switches are not affected.

Administrators can check NGOAM with the show feature | include ngoam, overlay status with the show feature | include nve, and SRv6 with the show feature | include srv6. Overlay checks also require reviewing show running-config | begin "interface nve", show nve vni, and show nve peers to establish whether the required configuration exists.

Cisco says no workarounds address the vulnerabilities, but turning off an unneeded NGOAM feature removes the attack vector. Administrators can use the no feature ngoam command in global configuration mode after assessing the effect on network operations. Cisco has also released Live Protect shields as temporary protection, not a replacement for patched software.

Organizations should use the Cisco Software Checker to identify the fixed release for their platform. CybersecurityNews previously covered a separate Nexus 9000 root-code-execution flaw, CVE-2026-20212, affecting Silicon One models.

That issue had different exposure conditions; administrators should assess this NGOAM advisory independently and schedule the appropriate NX-OS upgrade.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges appeared first on Cyber Security News.

Cisco has issued an urgent security advisory for a critical zero-day vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The flaw, tracked as CVE-2026-76460, is already being actively exploited, according to Cisco’s Product Security Incident Response Team.

The vulnerability carries a maximum CVSS score of 10.0. It could allow an unauthenticated remote attacker to bypass authentication on affected systems.

Cisco confirmed that no workaround is available, making immediate software updates the primary remediation step. The issue stems from insufficient authentication controls on an API endpoint in Cisco ISE.

An attacker can send a specially crafted request to the vulnerable endpoint and gain unauthorized access by bypassing the web-based management interface.

Cisco ISE is widely used by organizations to control network access, enforce security policies, authenticate users and devices, and provide visibility into connected assets.

Cisco ISE 0-Day Vulnerability Exploited

A successful compromise could therefore give attackers a high-value entry point into enterprise identity and network-management environments. Cisco warned that successful exploitation may allow threat actors to obtain command execution with root privileges.

Root-level access would provide full control over an affected ISE node, allowing attackers to alter configurations, deploy malicious tools, create persistence, steal credentials, or use the appliance as a staging point for lateral movement.

The vulnerability affects Cisco ISE and Cisco ISE-PIC regardless of device configuration. Cisco ISE Software Release 3.0 is also exposed, but it has reached the end of software maintenance. Organizations using version 3.0 should migrate to a supported release that includes the security fix.

Cisco released patches for supported versions of the platform. The fixed releases are ISE 3.1 Patch 12, ISE 3.2 Patch 11, ISE 3.3 Patch 12, ISE 3.4 Patch 7, and ISE 3.5 Patch 4.

Administrators should identify their deployed version and upgrade to the appropriate fixed release as soon as possible. For organizations unable to patch immediately, Cisco recommends using infrastructure access control lists, or iACLs, to limit management and control-plane traffic reaching vulnerable devices.

Only essential and trusted systems should be allowed to communicate with Cisco ISE management interfaces. However, Cisco stressed that this mitigation is only temporary and does not remove the underlying vulnerability.

Administrators should also investigate systems for signs of exploitation. Cisco advised reviewing the access.log file for suspicious usernames or unexpected API activity.

In distributed ISE environments, check every node because an attacker may target any accessible node. Cisco provided an example command for reviewing suspicious login-related events: show logging application ise-kong/access.log | include dummyuser.

Security teams should collect support bundles with debug logs enabled to access additional API gateway logs. Cisco noted that evidence on a compromised device may be incomplete because attackers with root-level access could remove or hide forensic artifacts.

Organizations should also examine firewall and network logs outside the affected appliance. Unexpected uploads from an ISE node to external IP addresses, suspicious downloads, and unexplained outbound connections may indicate compromise.

If malicious activity is identified or strongly suspected, Cisco recommends reimaging affected ISE nodes and restoring configurations from a known-good backup. The vendor discovered the vulnerability while resolving a Cisco Technical Assistance Center support case.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks appeared first on Cyber Security News.