Zero Radar
← feed
HighVulnerabilityCVE-2026-76491updated 27 Oct 2026, 14:49 UTC

Cisco Expressway: reachable assertion flaw can crash devices

A flaw in Cisco Expressway video-collaboration servers can make the device stop working when a specially crafted input reaches a certain internal check. Cisco says attackers have used this flaw.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesCisco October 2026 Expressway Series security hardening software release. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

A reachable assertion (CWE-617) in Cisco Expressway Series software (Expressway-C and Expressway-E), found during internal hardening review and grouped under this CVE with other issues.

Why it is dangerous: An attacker who can send crafted traffic to an affected Expressway device can cause it to fail, disrupting video and calling services for users. Organizations exposing Expressway-E to the internet are most at risk.

Are you affected?

You are affected if you run Cisco Expressway-C or Expressway-E devices on software versions earlier than the October 2026 hardening release.

Cisco Expressway Series (Expressway-C and Expressway-E) software prior to the October 2026 hardening release.

What to do

  1. Check your Expressway-C and Expressway-E software version in the admin interface.
  2. Upgrade both Expressway-C and Expressway-E to the Cisco October 2026 security hardening release or later.
  3. Review Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs for the full list of affected versions and related CVEs (CVE-2026-76490 to CVE-2026-76497).

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76491
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Expressway: reachable assertion flaw can crash devices · Zero Radar