Insufficient Authorization Vulnerability in Cisco Expressway Series

CVE-2026-76435

What is CVE-2026-76435?

A vulnerability has been identified in the Cisco Expressway Series that permits an unauthenticated, remote attacker to acquire sensitive information from the affected devices. The issue arises from inadequate authorization checks for HTTP requests during the Mobile and Remote Access (MRA) provisioning process. By crafting specific URL requests, an attacker could exploit this weakness, enabling them to gain access to confidential data that should be protected by authorization controls. This affects both the Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices.

References