/
← Voltar ao feed
medium

Cisco Expressway Series MRA provisioning flaw (CVE-2026-76435) allows unauthenticated information disclosure

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 2 dias

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed CVE-2026-76435, an information disclosure vulnerability in Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated, remote attacker can obtain sensitive information from an affected device. Cisco rates the Security Impact as Medium. Software updates are available, there are no workarounds, and the article does not report exploitation in the wild. The advisory is part of Cisco's October 21, 2026 advance-notification bundle.

Detalhes técnicos

  • The root cause is insufficient authorization checks on HTTP requests during Mobile and Remote Access (MRA) provisioning.
  • An attacker submits a crafted URL request to an affected device and can access information they are not authorized to see.
  • The article does not say what data is exposed or which software versions are affected.
  • The advisory ID is cisco-sa-expressway-inf-disc-vvYqgSTS.

Remediação

  • Apply the Cisco software updates that fix this vulnerability. No workarounds exist.
  • Review the Cisco Expressway Series Security Hardening Release: October 2026 for related improvements and fixes.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:00 primeiro registro só resumo do feed

    Cisco Expressway Series MRA provisioning flaw (CVE-2026-76435) allows unauthenticated information disclosure

    ler a análise desta fonte

    Cisco disclosed CVE-2026-76435, an information disclosure vulnerability in Cisco Expressway Series (Expressway-C and Expressway-E). An unauthenticated, remote attacker can obtain sensitive information from an affected device. Cisco rates the Security Impact as Medium. Software updates are available, there are no workarounds, and the article does not report exploitation in the wild. The advisory is part of Cisco's October 21, 2026 advance-notification bundle.

    Technical Details

    • The root cause is insufficient authorization checks on HTTP requests during Mobile and Remote Access (MRA) provisioning.
    • An attacker submits a crafted URL request to an affected device and can access information they are not authorized to see.
    • The article does not say what data is exposed or which software versions are affected.
    • The advisory ID is cisco-sa-expressway-inf-disc-vvYqgSTS.

    Remediation

    • Apply the Cisco software updates that fix this vulnerability. No workarounds exist.
    • Review the Cisco Expressway Series Security Hardening Release: October 2026 for related improvements and fixes.