A vulnerability in Cisco Expressway Series database service allows an unauthenticated remote attacker with network access to execute arbitrary operating system commands as root. The flaw originates from the use of persistent cookies and inadequate validation of client certificates when TLS Verify Mode is enabled for clustering. An attacker who obtains the cookies can connect to the database service and invoke specific RPC commands, resulting in full root‑level control of the device.

The affected products are Cisco TelePresence Video Communication Server Expressway devices, including both Expressway Core (Expressway-C) and Expressway Edge (Expressway-E). No specific version numbers are listed in the advisory, so all deployed instances running the vulnerable database service are potentially impacted.

The CVSS score of 9.8 indicates critical severity. EPSS is not available, and the vulnerability is not in the CISA KEV catalog, but the lack of authentication and the need for only network access make exploitation realistically feasible. The attack vector is network‑based and does not require local privileges; an attacker who can reach the device can exploit the flaw to gain root. This high impact and ease of exploitation justify an urgent response.