Cisco Expressway Series: Incorrect permission assignment (CWE-732)
Summary
Cisco Expressway-C and Expressway-E devices, both virtual and appliance versions, contain an incorrect permission assignment for critical resources. Cisco found the issue during an internal security review and grouped it with other hardening issues under one CVE. An attacker with local access and low privileges on the appliance could potentially raise their privileges and affect confidentiality, integrity and availability. Cisco has published no per-flaw details.
Affected
- Cisco Expressway-C and Expressway-E, virtual and appliance versions, regardless of configuration
- X15.5.3 and earlier, according to the advisory's fixed-release table
- X14 and earlier: no fix listed, migrate to a fixed release
- The CVE record also lists individual X8.x and X12.5.x releases; check the advisory for your exact build
Fixed in
- X15.5.20 (first fixed release listed in the advisory for the hardening group)
- No separate fixed version has been published for CVE-2026-76495 alone
Workaround
- None. Cisco states that no workarounds are available.
Exploitation
- Cisco states the issues are not known to be actively exploited and that its PSIRT is not aware of public announcements or malicious use.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
Our recommendation
- Check whether you run Expressway, and which version, on each device.
- Upgrade to X15.5.20 or a later fixed release. Migrate X14 and older devices.
- Prioritise clustered deployments, because the same release fixes CVE-2026-76466 (critical, unauthenticated root code execution), and one upgrade covers both.
- Monitor for unusual local logins and privilege changes until the upgrade is done.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-exwy-hardening-FhcqBVcs sec.cloudapps.cisco.com
- OpenCVE: CVE-2026-76495 app.opencve.io
- Rescana: Cisco Expressway October 2026 hardening release www.rescana.com
- VulDB: CVE-2026-76495 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:47.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.