# CVE-2026-76435: Cisco Expressway Series information disclosure in MRA provisioning

Source: https://junglewise.ai/threats/cve-2026-76435-a-vulnerability-in-cisco-expressway-series-could-allow-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-76435 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Cisco Expressway is a video and voice communications platform used by enterprises to connect remote and mobile workers. An unauthenticated attacker can exploit insufficient authorization checks in the Mobile and Remote Access (MRA) provisioning feature to access sensitive information they should not have access to, such as configuration data or credentials.

Technologies: [Cisco Expressway Core](https://junglewise.ai/threats/technologies/expressway-core), [Cisco Expressway Edge](https://junglewise.ai/threats/technologies/expressway-edge). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-76435 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76435 being exploited in the wild.

**How severe is CVE-2026-76435?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Cisco Expressway Core X15.5.2 and earlier; Cisco Expressway Edge X15.5.2 and earlier.

**Is there a fix for CVE-2026-76435?** Yes: fixed in Expressway Core and Expressway Edge: X15.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76435 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-76435?** Check whether you run Cisco Expressway Core or Cisco Expressway Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Expressway Core and Expressway Edge: X15.5.3

## Technical details

The vulnerability exists in the HTTP request handling during MRA provisioning due to insufficient authorization checks (CWE-497). An unauthenticated, remote attacker can craft a malicious URL and submit it to an affected device to bypass authorization controls. A successful exploit grants access to sensitive information without proper authentication or authorization.

## Affected products

- Cisco Expressway Core X15.5.2 and earlier
- Cisco Expressway Edge X15.5.2 and earlier

## Timeline

- 2026-10-21: disclosed: CVE-2026-76435 published
- 2026-10-21: patched: Fixed releases available

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-inf-disc-vvYqgSTS)

## Related threats

- [Cisco Expressway Series null pointer dereference](https://junglewise.ai/threats/cve-2026-76492-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Expressway Series reachable assertions denial of service](https://junglewise.ai/threats/cve-2026-76491-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)