EUVD-2026-107357
GHSA-qxrh-9p34-fg7x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged appliance user
-
ExploitPlant malicious symbolic link
-
ExecutionTrigger privileged link resolution
-
ImpactRead/overwrite protected files for full compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Exploitation requires local access to a Cisco Expressway Series / TelePresence VCS appliance together with a valid low-privileged authenticated account (AV:L, PR:L). The attacker abuses improper link resolution (CWE-59 / symlink following) so that a component operating at higher privilege follows an attacker-controlled link to an unintended file, yielding file read/overwrite with full CIA impact. The high attack complexity (AC:H) is itself a strong limiting factor, implying a race condition or a specific, non-default filesystem/timing state must be satisfied; no remote or unauthenticated path is indicated. Principal limiting factors: mandatory local presence on the appliance, prior authentication, and the difficult-to-reliably-win high-complexity precondition - there is no user-interaction requirement (UI:N). |
| Impact | The CVSS 3.1 base score of 7.0 (High) is driven entirely by the impact metrics (C:H/I:H/A:H), while the exploitability metrics substantially temper real-world risk: AV:L means the attacker must already have local access to the Expressway/VCS appliance, PR:L requires a valid low-privileged authenticated account, and AC:H indicates a non-trivial precondition such as a race or specific filesystem state must be won. No EPSS score, SSVC decision data, or KEV listing was provided in the input, and no public exploit was identified - these signals are absent rather than conflicting. The vulnerability was internally discovered during Cisco's own proactive security review (not reported from in-the-wild activity), which is consistent with the absence of exploitation evidence. On balance this is a genuine but not emergency-grade issue: it is a privilege/integrity concern for an attacker who already has a foothold on the appliance, rather than a remotely exploitable, mass-scannable flaw. Note a labeling inconsistency to verify: the input tag 'Information Disclosure' understates the vulnerability, since the CVSS vector asserts full High confidentiality, integrity, AND availability impact (CWE-59 link following), implying file overwrite/privilege effects beyond mere disclosure. |
| Exploit ScenarioDerived | A low-privileged but authenticated user on a Cisco Expressway/VCS appliance plants a malicious symbolic link in a location the software later resolves while operating with higher privilege, causing it to read, overwrite, or follow the link to sensitive files outside the intended path. Because the flaw requires local access, an authenticated session, and winning a high-complexity condition (AC:H), practical exploitation is limited to attackers who already have a foothold. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Improper link resolution in Cisco Expressway Series (TelePresence VCS Expressway lineage) lets a local attacker holding a valid low-privileged account trick a component running at higher privilege into following an attacker-controlled link, producing file read or overwrite with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.0). Real-world risk is strongly tempered by the exploitability metrics: the attacker must already be present on the appliance (AV:L), must authenticate with low privileges (PR:L), and must satisfy a non-trivial high-complexity precondition such as a race or specific filesystem state (AC:H), with no user interaction (UI:N) and no remote or unauthenticated path indicated. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Upgrade to the Cisco Expressway Series software hardening release identified in Cisco's advisory (patch available per vendor advisory; exact fixed build numbers are published at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs), and verify the running build after upgrade. Until patching is possible, reduce exposure by minimizing who can hold even low-privileged local accounts on the appliance - every such account is a viable PR:L foothold for this bug - and by tightly restricting SSH/CLI and administrative interface access to a small management network via ACLs, accepting that this limits legitimate troubleshooting access. Where the platform allows it, monitor writable directories used by privileged services for unexpected symbolic links or file-integrity changes and alert on them, trading some agent/performance overhead for early detection of a link-following attempt. Note that AC:H means exploitation is unreliable rather than impossible, so these controls are delaying measures, not substitutes for the hardening release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-59, Improper Link Resolution Before File Access ('Link Following'), a classic symlink-following class of bug: a privileged service or installer routine resolves a path inside a location an attacker can influence, so a crafted symbolic link redirects the operation to an unintended file. Because the vulnerable component executes at a higher privilege level than the attacker's account, the redirect yields read or overwrite of files the low-privileged user could not otherwise touch, which is why the impact metrics are uniformly high. The assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the flaw is only reachable from the local appliance context and that success depends on winning a difficult precondition, most plausibly a time-of-check/time-of-use race or a specific non-default filesystem/timing state; there is no user-interaction or remote-network trigger. CPE data maps the affected code to the Cisco TelePresence Video Communication Server (VCS) Expressway product line, and the advisory describes the fix as part of an internal security review producing hardening releases covering multiple internally discovered issues grouped under this CWE.
Know when Cisco Telepresence Video Communication Server Vcs Expressway gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Link-resolution abuse needs local access and a low-privileged account (AV:L, PR:L), a race/specific state makes it AC:H, and symlink-to-privileged-file yields full C/I/A impact without scope change.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.
Executive ViewAI
Cisco Expressway Series carries a high-severity flaw that could let an existing low-privilege local user damage or expose files on the collaboration appliance, putting communications availability and data trust at risk. The practical exposure is narrower because the attacker needs an authenticated local foothold and difficult preconditions, but the absence of a vendor patch makes these appliances a residual risk that leadership should track.
No vendor-released patch is identified at time of analysis; until a fixed Cisco Expressway Series release is available, restrict local shell/CLI and API access to trusted administrators, remove or disable unnecessary low-privileged local accounts, enforce least privilege and strong authentication, monitor for anomalous file access or configuration changes, and maintain offline backups.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deploym
Out-of-bounds write in Cisco Expressway Series (VCS Expressway) allows remote, unauthenticated attackers to trigger memo
Incorrect permission assignments in Cisco Expressway Series (CWE-732) can let a low-privileged local user read or modify
Code injection in Cisco Expressway Series (TelePresence Video Communication Server Expressway) allows a local attacker h
Denial of service in Cisco Expressway Series allows remote unauthenticated attackers to disrupt availability by triggeri
Denial of service in Cisco Expressway Series allows unauthenticated remote attackers to crash the service by triggering
Network-reachable assertion failures in Cisco Expressway Series (TelePresence VCS Expressway) can terminate video and co
Insecure temporary file handling in Cisco Expressway Series allows a local, low-privileged attacker to tamper with data
Information disclosure in Cisco Expressway Series (Expressway-C and Expressway-E) lets an unauthenticated, remote attack
Exploit-DB