Cisco Expressway Series: Code injection in software hardening release
Summary
Cisco has fixed a code injection weakness (CWE-94) in Expressway-C and Expressway-E in its October 2026 hardening release. Cisco has not publicly described the specific flaw. Exploitation requires local access with low privileges, but a successful attack could fully compromise confidentiality, integrity and availability of the device. Cisco reports no known exploitation.
Affected
- Cisco Expressway-C and Expressway-E, virtual and appliance versions, regardless of device configuration
- X15.5.3 and earlier according to the advisory's fixed-release table
- X14 and earlier: migration to a fixed release required
Fixed in
- X15.5.3 and earlier: upgrade to X15.5.20
- X14 and earlier: no fixed release on this line; migrate to a fixed release
Workaround
- No workarounds available (according to Cisco)
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Expressway-C and Expressway-E devices and their release numbers.
- Upgrade X15.5.3 and earlier systems to X15.5.20 or later.
- Plan migration of X14 and earlier devices, as no fix is available on that line.
- Restrict access to management and cluster interfaces, especially on Expressway-E in the DMZ.
- Monitor the Cisco advisory for revisions and check the affected release list directly against it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory: Expressway Series Security Hardening Release October 2026 sec.cloudapps.cisco.com
- OpenCVE: CVE-2026-76494 app.opencve.io
- Strix: CVE-2026-76494 www.strix.ai
- Threatint: CVE-2026-76494 cve.threatint.com
- Rescana: Cisco Expressway October 2026 hardening www.rescana.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:48.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.