{"id":"CVE-2026-76495","kind":"vulnerability","aliases":["CVE-2026-76495"],"related":[],"title":"Cisco Expressway: incorrect permission assignments allow unauthorized access, unknown impact","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.","summary":"Cisco's October 2026 Expressway hardening release groups internally found flaws. CVE-2026-76495 covers the incorrect permission assignment (CWE-732) flaws, with a maximum score of 7.8 (local access, low privileges). Cisco says none are known to be exploited and gives no per-flaw detail.","severity":"high","cvss":7.8,"epss":0.00106,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Expressway Series","fixed":["X15.5.20"],"affected":"<= X15.5.3; X14 and earlier","ecosystem":"vendor"}],"ecosystems":[],"tags":["cisco","expressway","expressway-c","expressway-e","infrastructure","local-access","video-collaboration"],"not_affected_if":[],"how_to_check":"Check the software version in the Expressway web UI (Status > Overview) or with 'xstatus SystemUnit' on the CLI. Anything on X15.5.3 or earlier, or on X14 or earlier, is vulnerable. I did not read the exact CLI command on a Cisco page, so confirm it.","fix":"Upgrade Cisco Expressway to X15.5.20 or later if you run X15.5.3 or earlier. X14 and earlier have no fix in their own train: migrate to a fixed release. Cisco lists no workarounds.","status":"open","published_at":"2026-10-21T17:19:09+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:08:19+00:00","updated_at":"2026-10-25T03:20:35+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-25T03:08:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cisco Expressway to a fixed release listed in the Cisco advisory (version numbers unknown from sources)","reach":"unknown","title":"Cisco Expressway: incorrect permission assignments allow unauthorized access, unknown impact","impact":"medium","summary":"Cisco Expressway Series contains multiple internally found flaws classified as incorrect permission assignment (CWE-732), fixed in hardening releases. The sources do not say which actions an attacker could take or what data is exposed.","category":"infrastructure","nicknames":[],"who_cares":["cisco","expressway","video-collaboration"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown access to Expressway resources due to permission flaws","analyst_note":"Find the Cisco security advisory for CVE-2026-76495 to confirm affected and fixed versions, required access, and the exact permissions impact.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Cisco Expressway Series video collaboration gateways. The sources do not list affected versions or configurations.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000561,"input_tokens":3420,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-76495 to confirm affected and fixed versions, required access, and the exact permissions impact.","search":"'-2026':12A,15A,47B,127C '-732':55B,148C '-76495':13A,16A,48B,128C '2026':38B '7.8':62B 'access':8A,31B,64B 'address':117C 'allow':6A 'assign':5A,53B,136C 'c':24B 'cisco':1A,17A,20B,35B,67B,85C,96C 'collabor':34B 'commit':88C 'common':142C 'comprehens':105C 'concern':133C 'conduct':103C 'cover':49B 'cve':11A,14A,46B,126C 'cwe':54B,145C,147C 'detail':81B 'discov':120C 'e':27B 'engin':100C 'enumer':144C 'exploit':74B 'expressway':2A,18A,21B,23B,26B,39B,97C 'expressway-':25B 'expressway-c':22B 'flaw':45B,56B,80B 'found':44B 'give':76B 'group':42B,139C 'harden':40B,114C 'impact':10A 'incorrect':3A,51B,134C 'infrastructur':28B 'intern':43B,106C,119C 'issu':132C 'known':71B 'local':30B,63B 'local-access':29B 'low':65B 'maximum':59B 'multipl':118C 'none':69B 'octob':37B 'ongo':87C 'part':83C 'per':79B 'per-flaw':78B 'permiss':4A,52B,135C 'privileg':66B 'proactiv':90C 'product':93C 'qualiti':94C 'relat':130C 'releas':41B,115C 'result':111C 'review':108C,110C 'say':68B 'score':60B 'secur':91C,107C 'seri':98C 'series':19A 'softwar':99C,113C 'team':101C 'track':124C 'unauthor':7A 'unknown':9A 'variant':146C 'video':33B 'video-collabor':32B 'vulner':121C,123C 'weak':143C","nicknames":[],"mitigations":[],"who_affected":"Every Cisco Expressway-C and Expressway-E, virtual or appliance, on X15.5.3 and earlier or X14 and earlier, regardless of configuration. Cisco rates the permission flaws as local with low privileges required, so the risk is mainly an attacker who already has a foothold or account on the device. There is no configuration that avoids it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:20:35Z","by":"analyst","run_id":698},"products":{"at":"2026-10-25T03:20:35Z","by":"analyst","run_id":698},"workarounds":{"at":"2026-10-25T03:20:35Z","by":"analyst","run_id":698},"who_affected":{"at":"2026-10-25T03:20:35Z","by":"analyst","run_id":698}},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76495","severity":null,"published_at":"2026-10-21T17:19:09+00:00","modified_at":"2026-10-22T23:19:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76495","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76495","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76495:698","url":null,"severity":null,"published_at":"2026-10-25T03:20:35+00:00","modified_at":"2026-10-25T03:20:35+00:00","first_seen_at":"2026-10-25T03:20:35+00:00","fetched_at":"2026-10-25T03:20:35+00:00","note":"Read Cisco PSIRT advisory cisco-sa-exwy-hardening-FhcqBVcs (grouped hardening release, 8 CVEs). Fixed X15.5.20; X14 and earlier must migrate. No workarounds, not known exploited. Per-flaw impact not disclosed; CVSS 7.8 local, low priv."}],"documents":[{"id":3129,"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs","title":"Cisco Expressway Series Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}