Cisco Expressway Series devices are vulnerable to an unauthenticated, remote attacker gaining root access. This critical vulnerability allows arbitrary operating system command execution. The flaw stems from persistent cookies and insufficient client certificate validation when TLS Verify Mode is enabled for clustering. An attacker can exploit this by possessing these cookies and invoking specific RPC commands on the database service. Successful exploitation grants root privileges on the affected device's operating system. Cisco Expressway Core and Edge devices are both impacted. Cisco has released software updates to address this vulnerability. There are no available workarounds to mitigate the risk. This advisory is part of a larger group of security advisories. Refer to Cisco's security advisories and hardening releases for further details. The vulnerability is identified as CVE-2026-76466.