EUVD-2026-107354
GHSA-5x6f-5q5v-vc4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed Expressway interface
-
DeliverySend crafted malformed request
-
ExploitTrigger uncaught exception (CWE-248)
-
ExecutionCrash service process
-
ImpactDenial of service on collaboration edge
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling completeness
|
| Exploitation Conditions | Exploitation requires network reachability to an affected Cisco Telepresence Video Communication Server (VCS) / Expressway Series instance; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, or user interaction are needed, so default network-exposed deployments are reachable by remote unauthenticated attackers. The limiting factors are that impact is confined to availability (service crash / DoS only - no data disclosure or code execution) and that exposure depends on whether the Expressway interface is reachable from the attacker's network position (e.g. Internet-facing traversal edge versus internal-only deployment). The input does not specify a required non-default feature or configuration mode, so the precise triggering interface/protocol should be verified against Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs. |
| Impact | This is an internally-discovered Cisco Expressway Series vulnerability (CWE-248, uncaught exception) with a CVSS 3.1 base score of 7.5 driven entirely by availability impact (C:N/I:N/A:H) - the attack vector is network-based, low-complexity, and requires no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). Despite the high CVSS, several signals point to lower real-world urgency: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public POC was identified - exploitation status is 'no public exploit identified at time of analysis.' Cisco reports this came from a proactive internal security review (hardening release) rather than from observed in-the-wild activity, which typically correlates with low immediate exploitation pressure. The impact is a denial-of-service only (availability), not code execution or data theft, so this is a patch-in-normal-cycle item for exposed Expressway deployments rather than an emergency, though network-reachable edge/traversal deployments warrant prompt remediation given PR:N/UI:N. NOTE: the input Tag 'Information Disclosure' conflicts with the CVSS vector and CWE - CWE-248 with C:N/I:N/A:H is a denial-of-service condition, not information disclosure; treat the tag as erroneous. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted network traffic to a reachable Cisco Expressway Series interface that triggers an uncaught exception in the processing logic, causing the affected service or process to crash. Repeated triggering results in denial of service against the collaboration/traversal edge. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggering uncaught exceptions in network-reachable service code, with CVSS 3.1 score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The issue is an internally discovered CWE-248 weakness addressed in Cisco hardening releases; no public exploit or CISA KEV entry is identified at time of analysis. Affected deployments are Cisco Telepresence Video Communication Server (VCS)/Expressway instances that have not applied the fixed releases listed in Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs.
RemediationAI
Apply the Cisco Expressway Series hardening release identified in Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs; the input does not provide an exact fixed version, so verify the fixed-release matrix in the advisory before upgrading. Until patching is complete, reduce exposure by restricting network access to Expressway interfaces with ACLs/firewalls to only trusted traversal and management networks (trade-off: can block legitimate remote endpoint registration/traversal traffic), and disable any unused edge or collaboration features (trade-off: reduces functionality and may not cover the specific exception path). Monitor Expressway services for unexpected restarts or process crashes and alert on availability anomalies; this is detection, not remediation. No public exploit is identified at time of analysis, but the unauthenticated network vector makes prompt patching of Internet-reachable deployments important.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-248 (uncaught exception) is a robustness failure where a program does not catch an exceptional condition on a reachable code path, allowing the exception to propagate and abort the affected process or service. In Cisco Expressway Series (CPE cpe:2.3:a:cisco:cisco_telepresence_video_communication_server_(vcs)_expressway:*:*:*:*:*:*:*:*), the vulnerable code is part of the collaboration edge/traversal infrastructure; a remote attacker can send crafted traffic that reaches the unhandled exception path. The assessed CVSS vector confirms network reachability with low complexity and no privileges or user interaction, but impact is limited to availability (C:N/I:N/A:H) - no confidentiality or integrity impact is established. Source tags include 'Information Disclosure', but that is not supported by the assessed vector; the CWE and vector point to service crash/DoS as the primary risk.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated trigger of an uncaught exception yields a service crash, so AV:N/AC:L/PR:N/UI:N with availability-only impact (A:H) and no confidentiality or integrity effect.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76493 are related to issues concerning uncaught exceptions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-248.
Executive ViewAI
Cisco Expressway Series and TelePresence VCS deployments face a high-severity availability risk: remote unauthenticated attackers can trigger service disruptions that may interrupt video communications and remote collaboration. Leadership should prioritize because these platforms often support business-critical telepresence, B2B video, and remote workforce connectivity, and disruption could affect many users simultaneously. No public exploit has been identified at time of analysis, but the vulnerability is remotely reachable and requires no credentials.
Restrict network access to Expressway/VCS service and management interfaces, segment these systems from untrusted networks, apply rate limiting or upstream filtering, monitor for service restarts and uncaught exceptions, and follow Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs guidance; no vendor-released patch identified at time of analysis, so apply interim mitigations until hardening releases are available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB