CVE-2026-76497

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.

Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.