Cisco Expressway Series vulnerabilities

A vulnerability in the database service of Cisco Expressway Series is caused by the use of persistent cookies and insufficient validation of client certificates when TLS Verify Mode is enabled for clustering. An unauthenticated remote attacker with network access can connect to the database service and invoke specific RPC commands, allowing execution of arbitrary operating system commands as root.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to insecure temporary files (CWE-377), addressed in software hardening releases. The vulnerabilities are grouped under this CVE identifier.

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.

Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains multiple internally discovered vulnerabilities related to out-of-bounds writes (CWE-787) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.

A vulnerability in Cisco Expressway Series is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An unauthenticated remote attacker could submit a crafted URL request to access sensitive information they are not authorized to access. This affects Expressway-C and Expressway-E devices.