Is CVE-2026-76435 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76435 being exploited in the wild.

How severe is CVE-2026-76435?

Medium severity, with a CVSS score of 5.3, published 21 October 2026.

Which products and versions are affected?

Cisco Expressway Core X15.5.2 and earlier; Cisco Expressway Edge X15.5.2 and earlier.

Is there a fix for CVE-2026-76435?

Yes: fixed in Expressway Core and Expressway Edge: X15.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76435 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-76435?

Check whether you run Cisco Expressway Core or Cisco Expressway Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76435: Cisco Expressway Series information disclosure in MRA provisioning

CVE-2026-76435 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Cisco Expressway is a video and voice communications platform used by enterprises to connect remote and mobile workers. An unauthenticated attacker can exploit insufficient authorization checks in the Mobile and Remote Access (MRA) provisioning feature to access sensitive information they should not have access to, such as configuration data or credentials.

Technologies: Cisco Expressway Core, Cisco Expressway Edge. Vendors: Cisco.

Quick answers

Is CVE-2026-76435 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76435 being exploited in the wild.
How severe is CVE-2026-76435?: Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?: Cisco Expressway Core X15.5.2 and earlier; Cisco Expressway Edge X15.5.2 and earlier.
Is there a fix for CVE-2026-76435?: Yes: fixed in Expressway Core and Expressway Edge: X15.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76435 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76435?: Check whether you run Cisco Expressway Core or Cisco Expressway Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Expressway Core and Expressway Edge: X15.5.3

Technical details

The vulnerability exists in the HTTP request handling during MRA provisioning due to insufficient authorization checks (CWE-497). An unauthenticated, remote attacker can craft a malicious URL and submit it to an affected device to bypass authorization controls. A successful exploit grants access to sensitive information without proper authentication or authorization.

Affected products

Cisco Expressway Core X15.5.2 and earlier
Cisco Expressway Edge X15.5.2 and earlier

Timeline

2026-10-21: disclosed: CVE-2026-76435 published
2026-10-21: patched: Fixed releases available

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.