# Cisco patches 18 Expressway Series flaws

Published: 2026-10-22 · Severity: routine · Sectors: Telecommunications
Canonical: https://vorant.io/reports/a2bcfa4a-2dce-5d97-ab92-32fd551d2603/cisco-patches-18-expressway-series-flaws

> Cisco fixed 18 vulnerabilities in Expressway Series, including unauthenticated root command execution and sensitive data exposure, no active exploitation reported.

NCSC-NL relayed a Cisco security advisory addressing 18 vulnerabilities in the Cisco Expressway Series collaboration gateway product line. The flaws span a wide range of weakness classes including path traversal, link following, cross-site scripting, SQL injection, code injection, out-of-bounds write, hard-coded credentials, and improper permission assignment. Two issues stand out: insufficient authorization checks during Mobile and Remote Access (MRA) provisioning that could let unauthenticated remote attackers access sensitive information, and a flaw in the database service's TLS Verify Mode used for clustering that could allow unauthenticated attackers with network access to execute root commands due to insufficient client certificate validation.

The remaining vulnerabilities were identified through Cisco's internal security reviews and cover resource control, authentication, input validation, access control, exception handling, null pointer dereference, reachable assertions, and insecure temporary file handling issues. Several carry critical CVSS scores (up to 9.8), indicating unauthenticated, network-exploitable conditions that could lead to access control bypass, unauthorized code execution, privilege escalation to root, and data exposure.

Cisco has released software hardening updates to remediate all identified issues; there is no indication in this advisory of active exploitation in the wild. Defenders operating Cisco Expressway Series (and related Cisco Unified Communications/VCS products referenced in the linked advisories) should prioritize patching per Cisco's published advisories, especially for the critical-rated authorization and TLS Verify Mode issues, and review exposure of MRA provisioning and clustering interfaces to untrusted networks.

## Mentioned in this report

- Vulnerabilities: CVE-2026-76435, CVE-2026-76466, CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481, CVE-2026-76487, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0451.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a2bcfa4a-2dce-5d97-ab92-32fd551d2603/cisco-patches-18-expressway-series-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup