Is CVE-2026-76495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76495 being exploited in the wild.

How severe is CVE-2026-76495?

High severity, with a CVSS score of 7.8, published 21 October 2026.

Which products and versions are affected?

Cisco Expressway-C X14 and earlier, X15.5.3 and earlier; Cisco Expressway-E X14 and earlier, X15.5.3 and earlier.

Is there a fix for CVE-2026-76495?

Yes: fixed in Expressway Series X15.5.20 and later; X14 and earlier require migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76495 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-76495?

Check whether you run Cisco Expressway-C or Cisco Expressway-E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76495: Cisco Expressway Series incorrect permission assignment

CVE-2026-76495 · Severity: high · CVSS 7.8 · Published 2026-10-21

Cisco Expressway Series, a platform that manages video and voice communications across enterprise networks, contains multiple critical security vulnerabilities discovered during internal review. The most severe issue involves incorrect permission assignments that could allow an unauthenticated attacker on the network to cause service outages or gain unauthorized access to sensitive system resources.

Technologies: Cisco Expressway-C, Cisco Expressway-E. Vendors: Cisco.

Quick answers

Is CVE-2026-76495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76495 being exploited in the wild.
How severe is CVE-2026-76495?: High severity, with a CVSS score of 7.8, published 21 October 2026.
Which products and versions are affected?: Cisco Expressway-C X14 and earlier, X15.5.3 and earlier; Cisco Expressway-E X14 and earlier, X15.5.3 and earlier.
Is there a fix for CVE-2026-76495?: Yes: fixed in Expressway Series X15.5.20 and later; X14 and earlier require migration to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76495 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-76495?: Check whether you run Cisco Expressway-C or Cisco Expressway-E at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Expressway Series X15.5.20 and later; X14 and earlier require migration to a fixed release

Technical details

The vulnerabilities are grouped across eight CWE categories (CWE-787, CWE-617, CWE-476, CWE-248, CWE-94, CWE-732, CWE-59, CWE-377) identified during internal security testing, with CVE-2026-76495 specifically addressing incorrect permission assignments (CWE-732). The issues affect both Expressway-C and Expressway-E deployments in virtual and appliance forms, are reachable over the network without authentication, and have not been observed in active exploitation. Cisco has released patched versions (X15.5.20 and later) that address all identified weaknesses.

Affected products

Cisco Expressway-C X14 and earlier, X15.5.3 and earlier
Cisco Expressway-E X14 and earlier, X15.5.3 and earlier

Timeline

2026-10-21: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.