cisco-sa-exwy-hardening-FhcqBVcsHighCVSS 8.6

Cisco Expressway Series Security Hardening Release: October 2026

Published
October 21, 2026
Last Modified
October 27, 2026

🔗 CVE IDs covered (8)

CVE-2026-76490 →CVE-2026-76491 →CVE-2026-76492 →CVE-2026-76493 →CVE-2026-76494 →CVE-2026-76495 →CVE-2026-76496 →CVE-2026-76497 →

📋 Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities.

These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.

Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release.

Cisco has released a software update that addresses these vulnerabilities. There are no workarounds that address these vulnerabilities.

This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-notice-QGwHnJ6k"].

CVE-2026-76495 — Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities (CVSS 3.1 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVE-2026-76492 — Cisco Expressway Series Software Hardening Release: October 2026 - NULL Pointer Vulnerabilities (CVSS 3.1 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVE-2026-76491 — Cisco Expressway Series Software Hardening Release: October 2026 - Denial of Service Vulnerabilities (CVSS 3.1 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVE-2026-76490 — Cisco Expressway Series Software Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities (CVSS 3.1 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) CVE-2026-76493 — Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities (CVSS 3.1 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) CVE-2026-76497 — Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities (CVSS 3.1 6.6, CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) CVE-2026-76494 — Cisco Expressway Series Software Hardening Release: October 2026 - Code Injection Vulnerabilities (CVSS 3.1 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVE-2026-76496 — Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities (CVSS 3.1 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

🎯 Affected products94

  • Cisco TelePresence Video Communication Server (VCS) Expressway
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.0
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.1
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.2
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.3
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.4
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.5
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.6
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.7
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.8
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.5.9
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.6.0
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.6.1
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.6.2
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.6.3
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.6.4
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.7
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.7.0
  • Cisco TelePresence Video Communication Server (VCS) Expressway X12.7.1
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.0
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.1
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.10
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.11
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.2
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.3
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.4
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.5
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.6
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.7
  • Cisco TelePresence Video Communication Server (VCS) Expressway X14.0.8
  • +64 more not shown

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address these vulnerabilities.

🔗 References (3)