EUVD-2026-107353
GHSA-4h68-8g8q-39mj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Expressway service over network
-
DeliverySend crafted malformed request
-
ExploitTrigger out-of-bounds write (CWE-787)
-
ExecutionCorrupt process memory
-
ImpactCrash service / deny availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access to a running affected Cisco Expressway/VCS appliance with no authentication and no user interaction, so an exposed edge deployment is the primary prerequisite. The description does not name a specific feature, protocol, or configuration mode that must be enabled, so the exact triggering service is unconfirmed from available data. The key limiting factor is impact scope: the flaw yields only an availability/DoS outcome (A:H, C:N/I:N), not data disclosure or code execution, and it affects only unpatched Expressway Series software versions covered by the hardening release. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 8.6) describes a remotely reachable, low-complexity, unauthenticated flaw with a changed scope but impact limited entirely to availability (C:N/I:N/A:H) - i.e. a denial-of-service condition arising from an out-of-bounds write (CWE-787), not confirmed remote code execution despite the memory-corruption primitive. No EPSS score, CISA KEV listing, or public exploit was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' Importantly, these issues were internally discovered during Cisco's own proactive security review rather than found through observed attacks, which is consistent with the absence of KEV/POC signals and argues against imminent widespread exploitation. The high base score is driven by the network/unauthenticated/low-complexity metrics and the scope change, but the real-world priority is tempered by the availability-only impact and the lack of any evidence of weaponization - this is a patch-promptly item for exposed Expressway edge devices rather than a confirmed in-the-wild emergency. One caveat: out-of-bounds writes can sometimes be escalated beyond DoS, so Cisco's A:H-only scoring should be treated as the vendor's current assessment and re-verified if a working exploit emerges. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reach to an internet-facing Cisco Expressway/VCS edge appliance sends crafted traffic that triggers an out-of-bounds write in the affected service, corrupting memory and crashing the process. Because Expressway commonly sits at the network edge for B2B video and MRA traversal, this can disrupt collaboration services for the whole organization. No public proof-of-concept was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memory corruption that can cause high availability impact, such as process crashes or appliance instability, while confidentiality and integrity remain unaffected per the assessed CVSS vector. The issue is one of multiple internally discovered out-of-bounds write flaws addressed in Cisco hardening releases, and unpatched Expressway deployments are affected. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
RemediationAI
Apply the Cisco Expressway Series hardening release referenced in Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs); patch availability is confirmed by the vendor advisory, but the provided data does not specify an exact fixed version, so verify the correct release in the advisory before upgrading. Because the assessed vector shows network-reachable, unauthenticated exploitation with availability-only impact, reduce exposure by restricting access to Expressway edge and administrative interfaces to trusted networks or authorized users and by monitoring for unexpected crashes, restarts, or resource exhaustion; these controls lower attack surface but do not substitute for patching, and restricting access can disrupt legitimate remote collaboration users. Since the exact triggering service or feature is not confirmed in the provided data, service-level blocking or feature disabling should be based on the vendor advisory or support guidance rather than guesswork.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Expressway Series, identified in CPE data as cisco_telepresence_video_communication_server_(vcs)_expressway, is an edge-facing collaboration and traversal gateway; the tracked issue is a CWE-787 out-of-bounds write, a memory-safety class in which software writes data past the bounds of an allocated buffer. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H indicates the flaw is reachable over the network with low complexity, needs no authentication or user interaction, and has a changed scope, but the demonstrated impact is availability-only (A:H) with no confidentiality or integrity impact (C:N/I:N). The advisory describes a hardening release covering multiple internally discovered out-of-bounds write issues, so the exact protocol or service path that triggers this CVE is not identified in the provided data; exploitation would be expected to cause memory corruption leading to crash or denial of service rather than code execution or data exposure.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Remote, unauthenticated, low-complexity reachability on an edge service with an out-of-bounds write causing availability loss only; scope changed as the vendor scored it, no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76490 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Executive ViewAI
Cisco Expressway Series (VCS Expressway) presents a high-severity availability risk because a remote memory-corruption flaw can crash processes or destabilize appliances that support collaboration and remote-access services. No vendor-released patch is identified at time of analysis, and no public exploit was identified at time of analysis, so leadership should focus on service continuity, exposure reduction, and readiness to deploy Cisco's fixed hardening release. Affected teams include network/collaboration operations and anyone relying on Expressway for remote access.
No vendor-released patch identified at time of analysis; interim mitigations include reducing internet exposure of Cisco Expressway Series/VCS Expressway, enforcing network ACLs and segmentation, placing appliances behind IPS/IDS monitoring, disabling unnecessary services or features, limiting administrative access to trusted management networks, and monitoring for process crashes or appliance instability. Apply the Cisco hardening release when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB