CVE-2026-76490
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
Risk Assessment
Out-of-bounds writes can lead to memory corruption, service crashes, or potentially code execution, affecting the availability and security of communications infrastructure.
Recommendation
Upgrade Cisco Expressway Series to the latest hardening release specified by Cisco. Review the Cisco security advisory for this version.
Other vulnerabilities in Cisco Expressway Series
See all- CVE-2026-76497Medium
Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.
- CVE-2026-76496High
Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).
- CVE-2026-76495High
Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).
- CVE-2026-76494High
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.
- CVE-2026-76493High
Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76492High
Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76491High
Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.
- CVE-2026-76435Medium
A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS