EUVD-2026-107356
GHSA-m5ww-hcj6-5hq5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on Expressway/VCS
-
ExploitIdentify resource with incorrect permissions (CWE-732)
-
ExecutionRead or modify protected file/resource
-
ImpactEscalate privileges and impact host confidentiality, integrity, availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Exploitation requires an attacker to already have LOCAL access with at least low-level privileges (AV:L, PR:L) on the Cisco Expressway Series / TelePresence Video Communication Server (VCS) host - there is no remote or unauthenticated path. The specific resource, file, or configuration object carrying the incorrect permissions is not named in the vendor description (grouped generically under CWE-732), so the precise trigger cannot be pinned down from available data. Limiting factors: the need for an existing local foothold and valid low-privilege credentials, no user interaction required (UI:N), scope unchanged (S:U). This substantially narrows realistic risk to insider or post-compromise escalation scenarios rather than internet-facing attack. |
| Impact | This is a moderate-priority, locally-exploitable issue rather than a remote-crisis vulnerability. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) explicitly requires LOCAL access (AV:L) and existing low-level privileges (PR:L), which sharply constrains real-world risk despite the HIGH confidentiality/integrity/availability impacts. The CWE-732 (incorrect permission assignment) root cause is consistent with this profile: an already-present low-privileged user abusing loose file/resource permissions to escalate, not an external attacker breaking in. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, and the vulnerability was internally discovered by Cisco's own engineering team during a proactive hardening review - all signals pointing to no known active exploitation. The absence of EPSS/KEV/POC data is expected for a freshly disclosed, vendor-found bug and should not be read as low risk by itself, but there is no positive exploitation signal either. One inconsistency to note: the input Tags label this 'Information Disclosure', yet the CVSS vector asserts I:H and A:H (full integrity and availability impact), so treating it as read-only disclosure would understate it - verify scope against the Cisco advisory. |
| Exploit ScenarioDerived | A low-privileged local user (or an attacker who has already gained a foothold on the Expressway/VCS host via another vector) leverages an incorrectly assigned permission on a sensitive file, directory, or process resource to read protected data and modify or disrupt the system, effectively escalating privileges. Because AV:L and PR:L are required, this is a local privilege-escalation chain, not remote compromise. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify protected resources, producing high confidentiality, integrity, and availability impact. Cisco addressed this issue, along with other internally discovered hardening problems, in Expressway Series hardening releases; no public exploit code was identified at time of analysis. The 7.8 CVSS score reflects local access requirements with low privileges, no user interaction, and unchanged scope, so this is not a remotely reachable or unauthenticated attack path.
RemediationAI
Apply the Cisco Expressway Series hardening release identified in Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs. Patch available per vendor advisory; exact fixed release version not specified in the provided data, so verify the release matching your deployment. Because exploitation requires local access and low privileges, reduce exposure by limiting local shell and administrative accounts, removing unnecessary low-privilege users, enforcing least privilege, and auditing file and configuration permissions on Expressway/VCS hosts. Restrict management and OS-level access to trusted administrators and monitor for unexpected file or configuration changes; these are compensating controls, not substitutes for the hardening release, and they carry operational overhead and may not block an attacker who already has a local account.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Expressway Series, including TelePresence Video Communication Server (VCS) Expressway, is an enterprise collaboration edge and traversal product. CWE-732 covers incorrect permission assignment for a critical resource; Cisco's advisory groups multiple internally discovered hardening fixes rather than naming a single file or configuration object. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H means the attacker must already have local access and low privileges, needs no user interaction, and can achieve high confidentiality, integrity, and availability impact within the same security scope. The CPE entry cpe:2.3:a:cisco:cisco_telepresence_video_communication_server_(vcs)_expressway:*:*:*:*:*:*:*:* identifies the product family with a wildcard version, so specific affected releases are not enumerated in the provided data. The Information Disclosure tag aligns with the confidentiality impact, while the vector also shows high integrity and availability impact.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-732 permission flaw abused by an existing low-privileged local user gives AV:L/PR:L/AC:L; full host compromise on success yields C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.
Executive ViewAI
Cisco Expressway Series carries a high-severity local permission-assignment vulnerability that can let low-privileged users read or modify protected resources, affecting confidentiality, integrity, and availability. The attack path requires local access and low privileges, so the primary business exposure is insider misuse or post-compromise lateral activity rather than remote unauthenticated attack. Leadership should prioritize this because no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, while Expressway systems often support critical collaboration and edge services.
Restrict local shell and CLI access to trusted administrators; enforce least privilege and review local account permissions; monitor and log access to protected resources; segment Expressway appliances from general user networks; apply the Cisco Expressway Series hardening release once confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB