CVE-2026-76497

Cisco Expressway Series Software Hardening Release: October 2026 - Insecure Temporary File Vulnerabilities

MEDIUM

6.6

CVSS Score

Published: October 21, 2026 at 04:18 PM UTC

Updated: October 22, 2026 at 02:17 PM UTC

1 product affected across 1 vendorTelepresence Video Communication Server

Using Cisco TelePresence Video Communication Server (VCS) Expressway by Cisco?

Get instant alerts when new vulnerabilities affect Cisco TelePresence Video Communication Server (VCS) Expressway - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.6

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76497 are related to issues concerning insecure temporary files that are grouped under the Common Weakness Enumeration (CWE) Base CWE-377.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Telepresence Video Communication Server · Cisco

90%

X12.5.0X12.5.1X12.5.2X12.5.3X12.5.4X12.5.5X12.5.6X12.5.7X12.5.8X12.5.9X12.6.0X12.6.1X12.6.2X12.6.3X12.6.4X12.7.0X12.7.1X14.0.0X14.0.1X14.0.10 X14.0.11X14.0.2X14.0.3X14.0.4X14.0.5X14.0.6X14.0.7X14.0.8X14.0.9X14.2.0 X14.2.1 X14.2.2 X14.2.5 X14.2.6 X14.2.7 X14.3.0X14.3.1X14.3.2X14.3.3X14.3.4X14.3.5X14.3.6X14.3.7X15.0.0X15.0.1X15.0.2X15.0.3X15.2.0 X15.2.1X15.2.2X15.2.3X15.2.4X15.2.4.X15.3.0X15.3.1X15.3.2X15.4.0X15.5.0X15.5.1X15.5.2X15.5.3X8.1X8.1.1X8.1.2X8.10.0X8.10.1X8.10.2X8.10.3X8.10.4X8.11.0X8.11.1X8.11.2X8.11.3X8.11.4X8.2X8.2.1X8.2.2X8.5X8.5.1X8.5.2X8.5.3X8.6X8.6.1X8.7X8.7.1X8.7.2X8.7.3X8.8X8.8.1X8.8.2X8.8.3X8.9X8.9.1X8.9.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: cverecord

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.6MEDIUMcisco

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-377

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card