Live › vulnerability › CVE-2026-76492
Go to dashboardCisco Expressway Series hardening release fixes multiple null pointer dereferences (CWE-476) found in internal testing. Network-reachable, no authentication or user interaction, impact is availability (DoS). Cisco says not known to be exploited; no workarounds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Cisco Expressway-C or Expressway-E, virtual or appliance, regardless of configuration, running X15.5.3 or earlier or X14 or earlier. An unauthenticated remote attacker can reach it over the network and the impact is availability. Teams that do not run Expressway can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Expressway Series (Expressway-C and Expressway-E) | vendor | X15.5.3 and earlier; X14 and earlier | X15.5.20 |
migrate to a fixed release (no version named); X15.5.20 is the first fixed release listedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.
This page as .md · .json · in your agent: get_signal("CVE-2026-76492")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.