Cisco Expressway Series: Out-of-bounds write in software hardening release
Summary
A software hardening release of Cisco Expressway Series (Expressway-C and Expressway-E, virtual and appliance) addresses CVE-2026-76490, an out-of-bounds write (CWE-787) rated 8.6 (High). According to the CVSS vector, a network-reachable attacker without privileges or user interaction could cause a denial of service by impacting availability only. Cisco states the issue was found internally and is not known to be exploited, and no workaround exists.
Affected
- Cisco Expressway-C and Expressway-E, virtual and appliance versions, regardless of configuration
- Expressway X14 and earlier: affected, no fix in this branch
- Expressway X15.5.3 and earlier: affected (exact boundary to be confirmed on the live advisory)
Fixed in
- Expressway X14 and earlier: migrate to a fixed release
- Expressway X15.5.x: upgrade to X15.5.20
Workaround
- Unknown. Cisco states there are no workarounds for these vulnerabilities.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- Found through internal testing; not known to be actively exploited.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial.
- No public proof of concept found.
Our recommendation
- Check whether Expressway-C or Expressway-E is in use, and especially whether any Expressway-E is internet-facing.
- Plan to upgrade to X15.5.20 or later; migrate devices on X14 and earlier to a supported fixed release.
- Apply the update in the same window as CVE-2026-76466, which is the more urgent item on the same platform.
- Restrict management and cluster interfaces to trusted networks as general hardening.
- Monitor availability of Expressway services and vendor advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory: Expressway Series Security Hardening Release October 2026 sec.cloudapps.cisco.com
- OpenCVE: CVE-2026-76490 app.opencve.io
- Strix: CVE-2026-76490 www.strix.ai
- Vulners: Cisco advisory CISCO-SA-EXWY-HARDENING-FHCQBVCS vulners.com
- OffSeq: Cisco Expressway Series Security Hardening Release October 2026 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:22.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.