---
id: "CVE-2026-76491"
kind: "vulnerability"
aliases: ["CVE-2026-76491"]
title: "Cisco Expressway: reachable assertions let remote requests crash the appliance"
severity: "high"
cvss: 7.5
epss: 0.00263
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cisco-expressway", "infrastructure", "network-appliance", "video-collaboration"]
not_affected_if: ["not-running-expressway"]
published_at: "2026-10-21T17:19:08+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T03:16:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76491", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76491", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Cisco Expressway: reachable assertions let remote requests crash the appliance

Cisco Expressway Series contains reachable assertion failures (CWE-617) found in an internal security review, which Cisco fixed in hardening releases. An attacker who can send crafted traffic can trigger an assertion that stops the service, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Upgrade Cisco Expressway to the fixed release named in Cisco's advisory (version unknown from the sources)

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76491
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76491

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.  

The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_