EUVD-2026-107350
GHSA-qw7h-fjr8-4575
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Expressway network interface
-
DeliverySend crafted malformed request
-
ExploitTrigger reachable assertion (CWE-617)
-
ExecutionProcess aborts, service crashes
-
ImpactDenial of service for collaboration traffic
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | The attacker needs network reachability to the Expressway service's exposed interface (the product is typically deployed as an edge firewall-traversal server for SIP/H.323 video and collaboration signaling), and sends crafted input that reaches a vulnerable assertion. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is indicated as required. The practical limiting factor is exposure: internet-facing Expressway-E edge nodes are directly at risk, whereas purely internal Expressway-C deployments behind network controls have a reduced attack surface. The Cisco description groups multiple internally discovered assertion issues under this CVE and does not name the exact triggering feature or protocol, so the precise vulnerable code path is not specified in the available data. |
| Impact | This is a network-reachable denial-of-service vulnerability (CWE-617 reachable assertion) in Cisco Expressway / TelePresence VCS Expressway. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent: remote, unauthenticated, low-complexity, with availability-only impact and no confidentiality or integrity loss - classic DoS. No EPSS score, KEV listing, or POC indicator was provided in the input. Per precision rules, there is no public exploit identified at time of analysis and no confirmed active exploitation. The vulnerability was internally discovered by Cisco's own engineering team during a proactive security review rather than reported from observed attacks, which generally correlates with lower near-term exploitation likelihood. Net assessment: a genuine availability risk for internet-facing Expressway edge deployments given unauthenticated network reachability, but not a confirmed-exploitation emergency - it ranks below RCE-class issues since impact is limited to service disruption with no data compromise or code execution. Key missing signals (EPSS, KEV, POC) mean exploitation probability cannot be quantified from the data provided. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network access to the Expressway's exposed signaling or management interface sends specially crafted input that triggers a reachable assertion, causing the process to abort and the service to crash. Because Expressway commonly sits at the network edge for firewall-traversal of video/collaboration traffic, a successful crash disrupts voice/video call connectivity for the organization. No public exploit code is identified in the provided data, and low attack complexity (AC:L) means no special timing or race conditions are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and collaboration signaling services, allowing remote attackers to cause a denial-of-service condition without authentication or user interaction (CVSS 7.5). The vendor advisory describes multiple internally discovered CWE-617 reachable-assertion issues fixed in hardening releases; the exact affected and fixed versions are not specified in the provided data. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
RemediationAI
Cisco has published a software hardening advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs that addresses the CWE-617 assertion issues; patch status is 'Patch available per vendor advisory,' but the provided data does not include an exact fixed version, so upgrade to the fixed release specified in that advisory rather than relying on an inferred version number. Until upgrading, reduce exposure by restricting SIP/H.323 and management access on Expressway-E to known trusted peer IP addresses and required ports using firewall/ACL rules, and by placing internal Expressway-C nodes behind network segmentation; these controls can break legitimate external collaboration and should be validated against business requirements. Monitor for unexpected process restarts or signaling outages as indicators of attempted assertion triggering, and review Cisco's advisory for any additional workarounds.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Expressway Series, including TelePresence VCS Expressway, is an edge firewall-traversal and collaboration signaling server for SIP/H.323 video. CWE-617 describes an assertion that is reachable by attacker-controlled input; when triggered, the affected process aborts, producing availability impact. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates remote exploitation with low complexity, no privileges or user interaction, and only availability impact. The CPE string cpe:2.3:a:cisco:cisco_telepresence_video_communication_server_(vcs)_expressway:*:*:*:*:*:*:*:* uses a wildcard version, indicating the product family is affected but not providing a precise version range; the Cisco advisory groups several internally discovered assertion issues and does not name the specific triggering protocol or feature.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated reachable assertion (AV:N/PR:N/UI:N/AC:L) causing service crash yields availability-only impact (A:H), with no confidentiality or integrity effect.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.
Executive ViewAI
Cisco Expressway Series (TelePresence VCS Expressway) is affected by a network-reachable denial-of-service condition that can terminate video and collaboration signaling services, creating business continuity risk for meetings and remote collaboration. No public exploit identified at time of analysis, but the absence of a vendor-released patch leaves affected deployments exposed to service interruption. Leadership should prioritize targeted network restrictions and vendor engagement to reduce outage impact.
Restrict network access to Expressway signaling interfaces via firewall/ACL and segmentation, enable rate limiting at the edge, monitor for unexpected service terminations, and maintain redundant/failover capacity; engage Cisco for hardening-release guidance since no vendor-released patch is identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB