Cisco Expressway Out-of-Bounds Write Flaw Rated High Severity

Cisco has issued software updates to resolve a high-severity out-of-bounds write vulnerability in its Expressway Series products. The flaw, tracked as CVE-2026-76490, was identified during an internal security review conducted by the Cisco engineering team.

What happened

Cisco’s Expressway Series software engineering team performed a comprehensive internal security review to improve product quality. This process revealed multiple internally discovered vulnerabilities related to out-of-bounds writes. Cisco addressed these issues by releasing software hardening updates for affected systems.

The specific flaw is classified under Common Weakness Enumeration CWE-787. Cisco rates the severity of CVE-2026-76490 as high, with a CVSS score of 8.6. The vendor has made fixes available for the identified vulnerable versions through these updates.

Why it matters

The vulnerability impacts the Cisco TelePresence Video Communication Server (VCS) Expressway. Affected versions include X8.11.2, X8.6, X8.11.3, and X8.2.2. Organizations running these specific releases are exposed to the risk until they apply the hardening updates.

Out-of-bounds write errors involve writing data beyond the allocated memory buffer. This weakness is tracked as CWE-787. Cisco conducted this review as part of its ongoing commitment to proactive security and product quality. The resulting releases address the internally discovered vulnerabilities.

What to watch

• Verify current Expressway software versions against the affected list provided by Cisco.
• Monitor vendor advisory pages for new hardening release notifications.
• Check system logs for unusual memory access patterns or crashes.
• Review network traffic for anomalies originating from video communication servers.

Signals worth monitoring

Teams usually look for unexpected process terminations or memory exceptions in server logs. Check whether application logs show repeated crash reports from the video communication service. Look for anomalies in network traffic that suggest unauthorized command execution. Monitor for sudden increases in outbound connections from the server. Verify that system integrity monitoring tools detect changes to binary files. Ensure that alerting systems capture failed authentication attempts from unexpected sources.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Cisco

• Inventory all Cisco Expressway servers to identify those running vulnerable versions.
• Apply the latest software hardening updates provided by Cisco to affected systems.
• Monitor server logs for signs of exploitation attempts or unusual behavior.
• Restrict network access to Expressway servers to trusted networks only.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Cisco products are affected by CVE-2026-76490?

The Cisco TelePresence Video Communication Server (VCS) Expressway versions X8.11.2, X8.6, X8.11.3, and X8.2.2 are affected.

How severe is this vulnerability?

Cisco rates the vulnerability as high severity with a CVSS score of 8.6.

How did Cisco discover this flaw?

Cisco’s internal security review identified the out-of-bounds write vulnerabilities during a proactive assessment.