Cisco Expressway: patch clustered deployments
Cisco fixed a root command execution flaw in clustered Expressway devices. The advisory reports no known malicious use.
- Vendor
- Cisco
- Exposure
- Application or configuration dependent
- Vendor severity
- 9.8 · CVSS 3.1
What happened
The flaw requires network access to the database service and possession of the relevant persistent cookies. Cisco lists X15.5.3 and earlier as affected and instructs X14 or older deployments to migrate. There is no vendor workaround.
Affected systems and fixes
| Product | Affected | Fixed release / action |
|---|---|---|
| Expressway X15.5.3 and earlier | Clustered deployments | X15.5.20 |
| Expressway X14 and earlier | Clustered deployments | Migrate to a fixed release |
Confirm the running version against the vendor advisory, including any distribution backports.
CISA exploitation evidence
Catalog 2026.10.23 · Checked Oct 24, 2026 UTC
No matching CVE appears in the reviewed catalog snapshot. This does not establish that exploitation has not occurred. Check the incident sources and vendor guidance.
Response checklist
Sources
Technical facts come from these sources. Priorities and suggested reviews are Oktsec’s analysis.
- Expressway remote code execution advisoryCisco · vendor · Checked Oct 23, 2026 UTC
Editorial record1 entry
Added to the local collection after reviewing original sources. Disclosure date is shown separately from Radar coverage.
Choose what to review
Get incident alerts and briefings
Act now incidents and team briefings, with sources and recommended actions.
Checking availability…