{"id":"CVE-2026-76435","kind":"vulnerability","aliases":["CVE-2026-76435"],"related":[],"title":"Cisco Expressway: unauthenticated MRA request leaks sensitive device information","description":"A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device.\r\n\r\nThis vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Access (MRA) provisioning. An attacker could exploit this vulnerability by submitting a crafted URL request to an affected device. A successful exploit could allow the attacker to access sensitive information that they would otherwise not have authorization to access.\r\nNote: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.","summary":"Cisco Expressway Core and Edge devices do not check authorization on certain HTTP requests made during Mobile and Remote Access provisioning. A remote attacker can send a crafted URL request without logging in and read sensitive information the device would normally protect.","severity":"medium","cvss":5.3,"epss":0.00341,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco","expressway","infrastructure","mobile-and-remote-access","on-prem-appliance"],"not_affected_if":["no-expressway-deployed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-21T17:19:06+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:20:51+00:00","updated_at":"2026-10-25T04:20:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:20:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cisco Expressway: unauthenticated MRA request leaks sensitive device information","impact":"low","summary":"Cisco Expressway Core and Edge devices do not check authorization on certain HTTP requests made during Mobile and Remote Access provisioning. A remote attacker can send a crafted URL request without logging in and read sensitive information the device would normally protect.","category":"infrastructure","nicknames":[],"who_cares":["cisco","expressway","mobile-and-remote-access","on-prem-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Sensitive device information readable by unauthenticated remote attackers","analyst_note":"Find the Cisco security advisory for CVE-2026-76435 to get affected versions, fixed releases and whether MRA must be enabled; sources provided only the NVD description.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-expressway-deployed"],"who_is_affected":"Organizations running Cisco Expressway Core (Expressway-C) or Expressway Edge (Expressway-E) devices with Mobile and Remote Access enabled are the ones exposed. Sources do not say which software versions are affected or whether MRA must be enabled to be exploitable, so check the Cisco advisory before ruling anyone out.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3483,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-76435':12A,15A 'access':23B,47B,105C,132C,143C 'affect':88C,122C 'allow':77C,128C 'applianc':27B 'attack':51B,81C,109C,130C 'author':37B,96C,141C 'c':155C 'certain':39B 'check':36B,97C 'cisco':1A,16B,28B,73C,145C,150C,158C 'core':30B,152C 'could':76C,110C,127C 'craft':55B,117C 'cve':10A,13A 'devic':8A,33B,66B,89C,123C,156C,164C 'due':93C 'e':163C 'edg':32B,160C 'exploit':111C,126C 'expressway':2A,17B,29B,74C,146C,151C,154C,159C,162C 'expressway-':161C 'expressway-c':153C 'http':40B,99C 'inform':9A,64B,85C,134C 'infrastructur':18B 'insuffici':95C 'leak':6A 'log':59B 'made':42B 'mobil':20B,44B,102C 'mobile-and-remote-access':19B 'mra':4A,106C 'normal':68B 'note':144C 'obtain':83C 'on-prem-appli':24B 'otherwis':138C 'prem':26B 'protect':69B 'provis':48B,107C 'read':62B 'refer':148C 'remot':22B,46B,50B,80C,104C 'request':5A,41B,57B,100C,119C 'send':53B 'sensit':7A,63B,84C,133C 'seri':75C,147C 'submit':115C 'success':125C 'unauthent':3A,79C 'url':56B,118C 'vulner':71C,91C,113C 'without':58B 'would':67B,137C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Cisco Expressway Core (Expressway-C) or Expressway Edge (Expressway-E) devices with Mobile and Remote Access enabled are the ones exposed. Sources do not say which software versions are affected or whether MRA must be enabled to be exploitable, so check the Cisco advisory before ruling anyone out.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76435","severity":null,"published_at":"2026-10-21T17:19:06+00:00","modified_at":"2026-10-22T14:17:45+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76435","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76435","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}