Cisco Expressway Series: Multiple Security Flaws

What happened

Cisco's advisory covers security vulnerabilities affecting Expressway Series and related products. Think of the advisory as a repair notice for different models of the same appliance: the right repair depends on the model and the version you have. Administrators need to match each installed product to its affected release and the corresponding fixed release or migration instruction.

The advisory identifies path traversal, cross-site scripting (XSS), SQL injection, and memory corruption. These terms describe different ways software can mishandle files, browser content, database requests, or memory. The available details do not connect each weakness type to a particular CVE, so they should not be treated as interchangeable descriptions of every vulnerability.

Alongside Expressway Series, the affected products include Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. The release table gives Expressway Series its own update path, while the other listed products share release guidance for CVE-2026-76473 and CVE-2026-76474.

Technical details

Path traversal describes a failure to keep file access within intended boundaries. Cross-site scripting, usually shortened to XSS, describes unsafe handling of content that can cause a browser to interpret it as executable content. SQL injection concerns input being interpreted as part of a database instruction. Memory corruption means software mishandles memory in a way that can alter its intended state. These definitions explain the listed weakness categories; they do not establish the behavior of an individual CVE in this advisory.

The available advisory details do not establish the underlying coding errors, affected interfaces, or attack preconditions for each vulnerability. They do not specify whether an attacker needs an account, a particular privilege level, user interaction, or access to a particular feature. There is also no NVD description available here to support a more detailed account of how an attack would work.

No CVSS score or CWE identifier is available for these entries. CVSS is a standardized way to summarize vulnerability severity using characteristics such as access requirements and potential impact. CWE identifies categories of software weaknesses. Without those assessments, assigning a severity rating, a specific weakness identifier, or an expected technical outcome would go beyond what is established.

The Expressway Series release entries cover CVE-2026-76466, CVE-2026-76490, CVE-2026-76491, CVE-2026-76492, CVE-2026-76493, CVE-2026-76494, CVE-2026-76495, and CVE-2026-76496. The entries for Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection cover CVE-2026-76473 and CVE-2026-76474. Additional CVEs are named in the advisory information, but their product-specific release mappings are not available here.

Weakness types: Path traversal, Cross-site scripting (XSS), SQL injection, Memory corruption

Who is affected

Everyday users

For everyday users, the practical issue is whether an organization they rely on operates an affected Cisco product and has completed the relevant update. The release guidance concerns those Cisco systems. It does not identify a separate update that an individual user should install on a personal device.

The weakness names alone do not establish that anyone's information was accessed or that a particular service was interrupted. None of the advisory's CVEs is listed in CISA's Known Exploited Vulnerabilities catalog, commonly called KEV, as of the catalog check. That catalog status does not resolve whether exploitation has occurred.

Developers

Developers who maintain integrations with these Cisco products should identify which product and release their integration depends on. An integration with Expressway Series needs to be checked against the Expressway Series release entries; an integration with Unified CM or another listed product needs its own matching entry. A shared advisory does not establish that every product has the same vulnerable component.

There is not enough technical detail to prescribe an application code change for a particular CVE. Coordinate with the team responsible for the Cisco deployment, follow the update steps in the vendor's advisory, and check that the integration's expected behavior still works after the update. Successful integration checks help confirm normal operation, but do not independently prove that a security fix is installed.

Server and IT admins

For Expressway Series, the table lists X14 and earlier with the instruction to migrate to a fixed release. It separately lists X15.5.3 and earlier with X15.5.20 and later as the fixed release range. These instructions apply to the Expressway Series CVEs mapped in the table. The migration entry does not name a destination release, so administrators should use the vendor advisory to determine the applicable destination.

For Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, the table lists 14 with an instruction to migrate to a fixed release. It lists 15 with 15SU5 and later as the fixed release range for CVE-2026-76473 and CVE-2026-76474. Because 15SU5 and later is explicitly identified as fixed, the broader 15 entry should be read together with that fixed-release guidance.

What to do now

1. Inventory installations of Expressway Series, Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Record each product's installed release so the advisory can be applied accurately.
2. For Expressway Series installations matching X15.5.3 and earlier, use the advisory's X15.5.20 and later fixed-release guidance. Follow the update steps in the vendor's advisory.
3. For Expressway Series installations matching X14 and earlier, follow the instruction to migrate to a fixed release. Check the vendor advisory for the applicable migration destination and update steps.
4. For Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection installations matching 15, check whether the installed release meets the 15SU5 and later fixed-release guidance for CVE-2026-76473 and CVE-2026-76474.
5. For those same products on 14, follow the advisory's instruction to migrate to a fixed release. Do not infer a migration procedure from the Expressway Series guidance.
6. Check the vendor advisory for product and release guidance on any other named CVEs relevant to your deployment. After updating, confirm the installed release and check the functions and integrations your organization uses.

If you can't update yet

• Check the vendor advisory for guidance on restricting access to affected systems while an update or migration is pending.
• Check the vendor advisory for guidance on reducing internet exposure. Treat any applicable access restrictions as temporary measures while completing the prescribed update or migration.

How to confirm the fix

• Confirm that each updated Expressway Series installation meets the applicable fixed-release guidance. For the listed affected range X15.5.3 and earlier, the table identifies X15.5.20 and later as fixed.
• Confirm that affected installations of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection meet the applicable 15SU5 and later guidance, or have completed the migration required by their release entry.
• For any entry that says to migrate to a fixed release, compare the destination release with the vendor advisory. Record the resulting product version and check normal operation; service availability alone does not confirm that the vulnerability is fixed.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

This advisory covers 16 CVEs, so check individual scores in the vendor advisory and on NVD.

Affected products and fixed versions 112 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vcs-static-cred-hr7EWZ8t
• Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcs
• Cisco advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3
• NVD: CVE-2026-76466
• NVD: CVE-2026-76473
• NVD: CVE-2026-76474
• NVD: CVE-2026-76475
• NVD: CVE-2026-76476
• NVD: CVE-2026-76477
• NVD: CVE-2026-76478
• NVD: CVE-2026-76479
• NVD: CVE-2026-76481
• NVD: CVE-2026-76490
• NVD: CVE-2026-76491
• NVD: CVE-2026-76492
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.