39,534 Cisco Expressway fingerprints and the clustering precondition for CVE-2026-76466

Cisco released three advisories on 21 October 2026 covering ten Expressway vulnerabilities. The critical CVE-2026-76466 (CVSS 9.8) lets an unauthenticated attacker run OS commands as root, but requires clustering to be configured. ZoomEye found 39,534 assets matching the Cisco Expressway fingerprint.

• CVE-2026-76466 at CVSS 9.8 requires clustering with TLS Verify Mode enabled
• Affected releases are X14 and earlier plus X15.5.3 and earlier; fix in X15.5.20
• ZoomEye counted 39,534 Cisco Expressway assets on 22 October 2026
• The other nine flaws were found partly using frontier AI models