{"id":"CVE-2026-76492","kind":"vulnerability","aliases":["CVE-2026-76492"],"related":[],"title":"Cisco Expressway: null pointer flaws in hardening release","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.  \r\n\r\nThe vulnerabilities tracked by CVE-2026-76492 are related to issues concerning null pointers that are grouped under the Common Weakness Enumeration (CWE) Base CWE-476.","summary":"Cisco Expressway Series hardening release fixes multiple null pointer dereferences (CWE-476) found in internal testing. Network-reachable, no authentication or user interaction, impact is availability (DoS). Cisco says not known to be exploited; no workarounds.","severity":"high","cvss":7.5,"epss":0.00263,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Expressway Series (Expressway-C and Expressway-E)","fixed":["X15.5.20"],"affected":"X15.5.3 and earlier; X14 and earlier","ecosystem":"vendor"}],"ecosystems":[],"tags":["cisco","expressway","expressway-c","expressway-e","infrastructure","self-hosted"],"not_affected_if":["none-known"],"how_to_check":"Check the installed Expressway software version in the web UI or CLI. Vulnerable: X15.5.3 and earlier, X14 and earlier. Fixed: X15.5.20 or later. Affects Expressway-C and -E, virtual and appliance, any configuration.","fix":"Upgrade Expressway-C/-E on X15.5.3 or earlier to X15.5.20. X14 and earlier: Cisco says 'migrate to a fixed release' (no version named); X15.5.20 is the first fixed release listed. No workarounds.","status":"open","published_at":"2026-10-21T17:19:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:29+00:00","updated_at":"2026-10-25T03:42:12+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-25T03:16:29Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Cisco Expressway Series to the software hardening release named in Cisco's advisory; the advisory version is unknown from these sources.","reach":"unknown","title":"Cisco Expressway: null pointer flaws in hardening release","impact":"medium","summary":"Cisco Expressway Series software has multiple null pointer dereference flaws (CWE-476) found in an internal security review. The sources do not say what an attacker gets beyond a likely crash or denial of service.","category":"infrastructure","nicknames":[],"who_cares":["cisco","expressway","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; null pointer flaws usually crash the service","analyst_note":"Find Cisco's advisory for CVE-2026-76492 to get affected and fixed versions, the attack vector and whether it is remotely triggerable.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Cisco Expressway Series appliances or software. The sources do not list affected versions or whether a default configuration is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000556,"input_tokens":3414,"output_tokens":429,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Cisco's advisory for CVE-2026-76492 to get affected and fixed versions, the attack vector and whether it is remotely triggerable.","search":"'-2026':10A,13A,119C '-476':48B,139C '-76492':11A,14A,120C 'address':109C 'and':21A 'authent':57B 'avail':63B 'base':137C 'c':20A,29B 'cisco':1A,15A,25B,37B,65B,77C,88C 'commit':80C 'common':133C 'comprehens':97C 'concern':125C 'conduct':95C 'cve':9A,12A,118C 'cwe':47B,136C,138C 'derefer':46B 'discov':112C 'dos':64B 'e':24A,32B 'engin':92C 'enumer':135C 'exploit':71B 'expressway':2A,16A,19A,23A,26B,28B,31B,38B,89C 'expressway-':30B 'expressway-c':18A,27B 'expressway-e':22A 'fix':42B 'flaw':5A 'found':49B 'group':130C 'harden':7A,40B,106C 'host':36B 'impact':61B 'infrastructur':33B 'interact':60B 'intern':51B,98C,111C 'issu':124C 'known':68B 'multipl':43B,110C 'network':54B 'network-reach':53B 'null':3A,44B,126C 'ongo':79C 'part':75C 'pointer':4A,45B,127C 'proactiv':82C 'product':85C 'qualiti':86C 'reachabl':55B 'relat':122C 'releas':8A,41B,107C 'result':103C 'review':100C,102C 'say':66B 'secur':83C,99C 'self':35B 'self-host':34B 'seri':39B,90C 'series':17A 'softwar':91C,105C 'team':93C 'test':52B 'track':116C 'user':59B 'vulner':113C,115C 'weak':134C 'workaround':73B","nicknames":[],"mitigations":[],"who_affected":"Any Cisco Expressway-C or Expressway-E, virtual or appliance, regardless of configuration, running X15.5.3 or earlier or X14 or earlier. An unauthenticated remote attacker can reach it over the network and the impact is availability. Teams that do not run Expressway can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:42:12Z","by":"analyst","run_id":774},"products":{"at":"2026-10-25T03:42:12Z","by":"analyst","run_id":774},"workarounds":{"at":"2026-10-25T03:42:12Z","by":"analyst","run_id":774},"how_to_check":{"at":"2026-10-25T03:42:12Z","by":"analyst","run_id":774},"who_affected":{"at":"2026-10-25T03:42:12Z","by":"analyst","run_id":774}},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76492","severity":null,"published_at":"2026-10-21T17:19:08+00:00","modified_at":"2026-10-22T14:17:47+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76492","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76492","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76492:699","url":null,"severity":null,"published_at":"2026-10-25T03:20:34+00:00","modified_at":"2026-10-25T03:20:37+00:00","first_seen_at":"2026-10-25T03:20:34+00:00","fetched_at":"2026-10-25T03:20:37+00:00","note":"Correction: removed unsourced CLI command from how_to_check; set who_affected from advisory text."},{"source":"analyst","external_id":"CVE-2026-76492:774","url":null,"severity":null,"published_at":"2026-10-25T03:42:12+00:00","modified_at":"2026-10-25T03:42:12+00:00","first_seen_at":"2026-10-25T03:42:12+00:00","fetched_at":"2026-10-25T03:42:12+00:00","note":"Read Cisco advisory cisco-sa-exwy-hardening: X15.5.3 and earlier fixed in X15.5.20; X14 and earlier told to migrate to a fixed release (no specific version). No workarounds, no known exploitation. Advisory CVSS 8.6 is the max for the CWE-476 group (NVD 7.5); sibling CVEs 76490-76497 share the advisory."}],"documents":[{"id":3129,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs","title":"Cisco Expressway Series Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}