EUVD-2026-107351
GHSA-75r2-77rp-xfmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed Expressway edge
-
ExploitSend crafted malformed request
-
ExecutionTrigger null pointer dereference
-
ImpactProcess crash / service disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is named in the description - exploitation requires only network reachability to the Cisco Expressway/VCS Expressway service, which per the CVSS vector (AV:N/AC:L/PR:N/UI:N) is remote, low-complexity, unauthenticated, and requires no user interaction. The practical limiting factor is network exposure: Expressway is typically deployed as an edge traversal node, so risk concentrates on internet-facing or externally-reachable instances, while internal-only deployments behind firewalls present a reduced attack surface. Impact is bounded to availability (service crash/DoS); there is no confidentiality or integrity consequence, and the attacker gains no code execution or access. Exact affected/fixed software versions are not stated in the provided description and must be confirmed against the Cisco advisory. |
| Impact | This is a null pointer dereference (CWE-476) producing a denial-of-service condition, confirmed by Cisco's own tags and the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5). The impact profile is availability-only (A:H, with C:N and I:N) - there is no code execution, data disclosure, or integrity compromise, so despite the 'High' severity label this is a crash/DoS issue rather than a system-takeover flaw. The vector indicates network-reachable, low-complexity, unauthenticated triggering (AV:N/AC:L/PR:N/UI:N), which raises exploitability, but several real-risk signals are MISSING: no EPSS score, no CISA KEV listing, and no POC were provided in the input, so there is no public exploit identified at time of analysis. The vulnerability was internally discovered by Cisco during a proactive security review (not reported from in-the-wild observation), which further suggests it is not currently being exploited. Net assessment: a legitimately network-reachable unauthenticated DoS worth patching on exposed Expressway edge deployments, but NOT a top-tier emergency - the ceiling of harm is service disruption, and no evidence of active or imminent exploitation exists in the provided data. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request over the network to an internet-facing Cisco Expressway/VCS edge node, triggering a null pointer dereference in the affected component. The resulting crash causes a denial of service, disrupting video communication and collaboration traversal services. No public proof-of-concept is identified in the available data, and the impact is limited to availability - no code execution or data access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering a null pointer dereference (CWE-476). The issue is network-reachable, low complexity, and requires no user interaction, with impact limited to availability; exact affected and fixed releases must be confirmed in Cisco's advisory. No public exploit code was identified at time of analysis, and exposure is greatest for internet-facing or externally reachable Expressway deployments.
RemediationAI
Cisco has released hardening updates (patch available per vendor advisory), but the exact fixed version is not included in the provided data; apply the release referenced in Cisco's advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs and verify the applicable upgrade path there. Until the update is applied, reduce exposure by restricting network access to Expressway traversal and management interfaces to trusted sources with firewall rules or ACLs, especially for internet-facing deployments, and monitor for unexpected service crashes or restarts. These access controls may limit legitimate remote collaboration traffic and should be scoped to preserve required connectivity; no other specific workaround is identified in the available data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Expressway Series, identified in CPE as Cisco Telepresence Video Communication Server (VCS) Expressway, is an edge traversal and collaboration gateway. The vulnerability class is CWE-476 null pointer dereference, meaning the software follows or uses a pointer that is null, typically because an unexpected input or state is not validated, causing the process to terminate. Cisco describes this CVE as part of a hardening release covering multiple internally discovered null-pointer issues, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector confirms a remote, low-complexity, unauthenticated denial-of-service condition with no confidentiality or integrity impact. Because Expressway is commonly exposed at the network edge, internet-facing instances carry the highest practical risk.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity trigger (AV:N/AC:L/PR:N/UI:N); null pointer dereference causes a crash, so A:H with no confidentiality or integrity impact (C:N/I:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.
Executive ViewAI
Cisco Expressway Series carries a high-severity availability risk: a network-reachable flaw can crash the service and interrupt remote collaboration and edge connectivity for dependent users. No vendor-released patch was identified at time of analysis and no public exploit was identified, so leadership should focus on limiting external exposure and ensuring rapid detection of service outages.
No vendor-released patch identified at time of analysis; restrict network access to Cisco Expressway Series through firewall/ACL rules, minimize internet exposure, segment management interfaces, monitor for service crashes/restarts, and maintain redundant instances pending Cisco advisory workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB