Cisco Expressway Series security hardening update
Cisco has released a software hardening update to address eight vulnerabilities (CVE-2026-76490 through CVE-2026-76497) identified during an internal security review of the Expressway Core and Edge series.
CVE search metadata
CVE search record: CVE-2026-76490. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76491. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76492. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76493. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76494. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76495. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76496. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
CVE search record: CVE-2026-76497. KEV: no. Product: Expressway Core, Expressway Edge. Brief: Cisco Expressway Series security hardening update. Brief link: https://feed.craftedsignal.io/briefs/2026-10-cisco-expressway-hardening/
Triage facts
Revision 1- Applicability
- Expressway Core, Expressway Edge
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 21, 17:08 UTC
- Vulnerabilities
- 8 CVEs
- Source quality
- A1Unlikely
Cisco has released a security hardening update for the Cisco Expressway Series, including both Expressway Core and Expressway Edge devices. This update addresses eight vulnerabilities discovered during an internal security review. Cisco notes that these vulnerabilities were discovered internally, are not known to be actively exploited, and have no available workarounds. Cisco has grouped these vulnerabilities by their underlying Common Weakness Enumeration (CWE) class, assigning each group a unique CVE identifier. Further details regarding individual vulnerabilities may be provided in subsequent separate security advisories.
Impact
Cisco has assigned a High severity rating to the vulnerabilities addressed in this release. There is no evidence of active exploitation at this time.
Recommendation
- Inventory all Cisco Expressway Core and Expressway Edge deployments to ensure visibility.
- Apply the latest software hardening update provided by Cisco to all affected instances immediately, as no workarounds are available.
- Monitor the Cisco Security Intelligence website for future granular advisories regarding these specific CVEs (CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497).
Immediate actions
Upgrade all Cisco Expressway Core and Edge devices to the current hardened software release
Mitigations
Apply provided software hardening update
CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, CVE-2026-76496, CVE-2026-76497