CVE-2026-76435
Cisco Expressway Series Information Disclosure Vulnerability
Reported by cisco · Published October 21, 2026
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | X8.11.2, X8.6, X8.11.3 |
| Cisco | Cisco TelePresence Video Communication Server (VCS) Expressway | 15.2.0, 15.2.1, 15.2.2 |
Timeline
- Oct 21, 2026 CVE Published
- Oct 22, 2026 EPSS Score (3 in total, the first dated here)
- Oct 22, 2026 Coalition ESS Score
- Oct 22, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-76435
vulnetix vdb fixes CVE-2026-76435Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-76435/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart