CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76435
Advisory Summary
📅 October 21, 2026
🔐 📣 Cisco Expressway Series – Information Disclosure (Unauthenticated MRA Provisioning)
🚨 ⚠️ Risk Summary (Medium)
Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) may expose sensitive information to an unauthenticated, remote attacker. This is enabled by insufficient authorization checks for HTTP requests during Mobile and Remote Access (MRA) provisioning.
- An attacker sends a crafted URL request to an affected device
- If successful, the attacker can access information they are not authorized to retrieve
🆔 CVE
CVE-2026-76435
- Software updates are released to remediate the issue
- No workarounds are available
🧠 📌 Actionable Guidance for Market Professionals
1. Inventory exposure immediately: identify Expressway-C/Expressway-E systems participating in MRA provisioning.
2. Prioritize patching: treat as a remotely reachable, authorization-bypass-adjacent disclosure risk—remediate quickly based on internet exposure and data sensitivity.
3. Validate post-update behavior: confirm provisioning-related HTTP flows enforce proper authorization controls.
4. Harden the edge: align deployments with Cisco Expressway security hardening guidance (especially for management/provisioning endpoints).
-2026-76435
Reference: Vendor Advisory