GCVE-110-NCSC-2026-451

Advisory PublishedCVSS 6.6/10

Vulnetix · Advisory published October 22, 2026

A vulnerability in Cisco Expressway Series allows unauthenticated remote attackers to bypass authorization checks during Mobile and Remote Access provisioning, enabling them to access sensitive device information.

Download JSON Open in Console

Weaknesses (CWE)

CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereCWE-798Use of Hard-coded CredentialsCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CWE-749Exposed Dangerous Method or FunctionCWE-787Out-of-bounds WriteCWE-617Reachable AssertionCWE-476NULL Pointer DereferenceCWE-248Uncaught ExceptionCWE-94Improper Control of Generation of Code ('Code Injection')CWE-732Incorrect Permission Assignment for Critical ResourceCWE-59Improper Link Resolution Before File Access ('Link Following')CWE-377Insecure Temporary File

Risk Scores

CVSS 3.1

6.6/10

Medium · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Cisco	vers:unknown/*	—	—

Aliases

CVE-2026-76435 CVE-2026-76466 CVE-2026-76473 CVE-2026-76474 CVE-2026-76475 CVE-2026-76476 CVE-2026-76477 CVE-2026-76478 CVE-2026-76479 CVE-2026-76481 CVE-2026-76487 CVE-2026-76490 CVE-2026-76491 CVE-2026-76492 CVE-2026-76493 CVE-2026-76494 CVE-2026-76495 CVE-2026-76496 CVE-2026-76497

References

advisory

Browse GCVE Records

801 records in the GCVE database · Updated November 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON