EUVD-2026-107355
GHSA-mxp3-2247-mw6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliverySubmit crafted input to vulnerable component
-
ExploitTrigger code injection (CWE-94)
-
ExecutionExecute arbitrary code on appliance
-
ImpactFull compromise of Expressway device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access with an existing low-privileged authenticated account on the Cisco Expressway/VCS Expressway appliance (per PR:L and AV:L); it is NOT remotely exploitable over the network according to the scored vector, and no user interaction is needed (UI:N). The vendor description does not name the specific vulnerable feature, interface, or configuration, so the exact injectable component cannot be pinned from available data - consult Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs for the affected function and fixed release. The principal limiting factors are the local attack vector and the authentication requirement, which confine risk to environments where untrusted or lower-trust users hold accounts on the appliance. |
| Impact | This is a code-injection flaw (CWE-94) in Cisco Expressway Series / TelePresence Video Communication Server (VCS) Expressway, disclosed by Cisco's own internal security review rather than external reporting or observed attacks. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) describes a LOCAL attack requiring low-level privileges (an authenticated account on the device) but yielding full confidentiality, integrity, and availability compromise once triggered - effectively local privilege escalation to code execution. There is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data; exploitation status is therefore 'no public exploit identified at time of analysis.' The 'RCE' tag CONFLICTS with the CVSS attack vector: AV:L indicates local (not remote/network) exploitation, so the vulnerability is not remotely reachable per the scored vector - this discrepancy should be verified against the Cisco advisory before treating it as remote. Net assessment: a genuinely high-impact issue warranting prompt patching on exposed/multi-user appliances, but the local vector plus required authentication substantially lowers real-world risk versus a network-unauthenticated RCE; absent EPSS/KEV/POC signals, this is a patch-on-maintenance-cycle priority rather than an emergency, unless the appliance grants shell/CLI access to lower-trust operators. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on a Cisco Expressway/VCS Expressway appliance supplies crafted input to a vulnerable interface that fails to sanitize it, injecting code that executes in the appliance's context. Because the scope is unchanged but impact is High across C/I/A, this yields full compromise of the device. No public exploit code is known; the flaw was found internally by Cisco. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker holding a low-privileged account to execute arbitrary code on the appliance, with high confidentiality, integrity, and availability impact. Cisco found the flaw during an internal hardening review, and the CVSS 7.8 vector is local (AV:L) with low privileges required (PR:L), so risk is confined to deployments where lower-trust users already have credentials on the system. No public exploit code or confirmed active exploitation was identified at time of analysis.
RemediationAI
Apply the Cisco hardening release identified in advisory cisco-sa-exwy-hardening-FhcqBVcs (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs); the exact fixed version is not specified in the provided data, so confirm it from the advisory before upgrading. Because exploitation requires local access with a low-privileged authenticated account, prioritize interim controls that shrink the local account attack surface: remove dormant or unnecessary accounts on the Expressway/VCS appliance, enforce least privilege and strong authentication for remaining accounts, and restrict management/CLI access to trusted administrative networks via ACLs or firewall rules. Trade-offs: aggressive account cleanup and management-network restrictions can disrupt legitimate operator workflows, so validate changes against normal administration and integrations. Monitor appliance logs for unexpected local command execution or privilege changes, and treat the advisory as the authoritative source for any feature-specific workaround since the exact injectable component is not named in the available data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-94 code injection, meaning attacker-controlled input can reach an interpreter or execution path without proper neutralization, allowing injected code to run in the context of the affected process. The affected product identified by CPE is Cisco TelePresence Video Communication Server (VCS) Expressway, the collaboration edge/firewall-traversal component of the Cisco Expressway Series; the CPE uses a wildcard version, so the provided data does not enumerate a precise version range. Cisco states the flaws were internally discovered during a proactive security review and addressed through software hardening releases. The scored vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access and an existing low-privileged authenticated account and does not require user interaction; the vendor description does not name the specific vulnerable feature or interface, so the exact injectable component should be confirmed from Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Code injection reachable only by a local low-privileged authenticated user (AV:L, PR:L), low complexity, no UI, full host C/I/A compromise within an unchanged scope.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.
Executive ViewAI
Cisco Expressway Series and VCS Expressway collaboration appliances are affected by a high-severity local code-injection flaw that could allow an authenticated low-privileged local user to execute arbitrary code and compromise the appliance's confidentiality, integrity, and availability. The risk is concentrated in deployments where lower-trust users already hold credentials on the system; no public exploit was identified at time of analysis, and no vendor-released patch was identified. Leadership should prioritize account hygiene and management-access restrictions because these appliances support remote collaboration and could become a foothold if local access controls are weak.
No vendor-released patch identified at time of analysis; restrict SSH/CLI and management access to trusted administrators, remove or disable unnecessary low-privileged local accounts, enforce least privilege, segment appliances, and monitor for unauthorized code execution or configuration changes; apply Cisco workarounds per advisory until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB