Medium [CVE-2026-76435] Cisco Expressway Series Information Disclosure Vulnerability
This medium-severity Cisco advisory covers CVE-2026-76435 affecting TelePresence Video Communication Server (VCS) Expressway.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Cisco publishes the next one.
VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.
This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device.
A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.
Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.
In addition, for further documentation of improvements and fixes in Cisco Expressway Series see Cisco Expressway Series Security Hardening Release: October 2026.
Affected product named by the advisory: TelePresence Video Communication Server (VCS) Expressway.
- Scope: At the time of publication, this vulnerability affected Cisco Expressway-C and Cisco Expressway-E, both virtual and appliance versions, regardless of device configuration.
- X14 and earlier — Migrate to a fixed release
- Release X15.5.2 and earlier (first fixed: X15.5.3)
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release X14 and earlier: migrate to a fixed release.
- Release X15.5.2 and earlier: upgrade to X15.5.3.
- There are no workarounds that address this vulnerability.
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
More Cisco advisories
- CVE-2026-76466Oct 21, 2026Cisco Expressway Series Remote Code Execution Vulnerability
- CVE-2026-76490Oct 21, 2026Cisco Expressway Series Security Hardening Release: October 2026
- CVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- cisco-sa-notice-I8z3n6lKOct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
- CVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js Affecting Cisco Products: October 2026
- cisco-sa-emudhra-info-ScS22A1rOct 23, 2026Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.