Cisco patches 18 Expressway Series flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Cisco fixed 18 vulnerabilities in Expressway Series, including unauthenticated root command execution and sensitive data exposure, no active exploitation reported.
NCSC-NL relayed a Cisco security advisory addressing 18 vulnerabilities in the Cisco Expressway Series collaboration gateway product line. The flaws span a wide range of weakness classes including path traversal, link following, cross-site scripting, SQL injection, code injection, out-of-bounds write, hard-coded credentials, and improper permission assignment. Two issues stand out: insufficient authorization checks during Mobile and Remote Access (MRA) provisioning that could let unauthenticated remote attackers access sensitive information, and a flaw in the database service's TLS Verify Mode used for clustering that could allow unauthenticated attackers with network access to execute root commands due to insufficient client certificate validation.
The remaining vulnerabilities were identified through Cisco's internal security reviews and cover resource control, authentication, input validation, access control, exception handling, null pointer dereference, reachable assertions, and insecure temporary file handling issues. Several carry critical CVSS scores (up to 9.8), indicating unauthenticated, network-exploitable conditions that could lead to access control bypass, unauthorized code execution, privilege escalation to root, and data exposure.
Cisco has released software hardening updates to remediate all identified issues; there is no indication in this advisory of active exploitation in the wild. Defenders operating Cisco Expressway Series (and related Cisco Unified Communications/VCS products referenced in the linked advisories) should prioritize patching per Cisco's published advisories, especially for the critical-rated authorization and TLS Verify Mode issues, and review exposure of MRA provisioning and clustering interfaces to untrusted networks.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0451.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,082 reports from 142 sources, 541 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs