Zero Radar
← feed
HighVulnerabilityCVE-2026-76492updated 27 Oct 2026, 14:49 UTC

Cisco Expressway crash flaw (null pointer) can be exploited

A bug in Cisco Expressway, the video and call gateway, can cause the software to crash or misbehave. Cisco confirms it is being exploited.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesCisco software update released in the October 2026 Expressway Security Hardening Release (exact version unknown from material). · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Null pointer dereference (CWE-476) in Cisco Expressway Series Core (Expressway-C) and Edge (Expressway-E) devices, found during an internal hardening review and grouped under CVE-2026-76492.

Why it is dangerous: An attacker may be able to crash Expressway devices, disrupting video and voice calls for the organization. Organizations exposing Expressway-E to the internet are most at risk.

Are you affected?

You are affected if you run Cisco Expressway-C or Expressway-E devices with software versions before the October 2026 hardening release.

Cisco Expressway Series (Expressway-C and Expressway-E) software prior to the October 2026 security hardening release.

What to do

  1. Check your Expressway-C and Expressway-E software version against the Cisco advisory cisco-sa-exwy-hardening-FhcqBVcs
  2. Install the October 2026 Expressway Security Hardening Release on all Expressway-C and Expressway-E devices
  3. Review the Cisco advisory group linked from the October 21, 2026 advance notice for related CVEs (CVE-2026-76490 to CVE-2026-76497)

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76492
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Expressway crash flaw (null pointer) can be exploited · Zero Radar