Key points
- CVE-2026-76490 affects multiple Cisco Expressway X8.11 and X8.6 software versions.
- The flaw is an out-of-bounds write weakness classified as CWE-787 with a CVSS score of 8.6.
- Cisco has released software hardening updates that address this internally discovered vulnerability.
Cisco has released software updates for its Expressway Series to address a high-severity security flaw. The vulnerability, tracked as CVE-2026-76490, affects specific versions of the Cisco TelePresence Video Communication Server (VCS) Expressway. Affected releases include X8.11.2, X8.11.3, X8.6, and X8.2.2. Security teams managing these video communication systems need to verify their current software versions against this list. The vendor has made patched releases available to customers.
In plain English
The core issue is an out-of-bounds write error. This type of flaw occurs when a program writes data to a memory location outside the designated buffer. In this case, the weakness is categorized under CWE-787. The National Vulnerability Database rates the severity as high, assigning it a CVSS score of 8.6. This score reflects the potential impact of the flaw on system integrity and availability.
The background
Cisco identified this vulnerability through its own internal security review process. The company states that it conducts these reviews as part of a commitment to proactive security and product quality. This discovery led to the creation of software hardening releases. These updates are designed to address multiple internally discovered vulnerabilities, with CVE-2026-76490 being the specific identifier for the out-of-bounds write issues in these Expressway versions.
What changes now
Administrators must apply the latest software hardening releases to their Expressway systems. The update process involves installing the patched versions of the affected software. Since the flaw was discovered internally, there is no indication of active exploitation in the wild. However, the high severity rating means that unpatched systems remain vulnerable to potential attacks. Teams should prioritize updating any instance running X8.11.2, X8.11.3, X8.6, or X8.2.2.
Who needs to act first
Teams should prioritize systems exposed to untrusted networks or the internet. Check whether your Expressway instances handle external video calls or federation requests. Roll out the fix in stages, starting with the most exposed endpoints. Test the update in a non-production environment first to ensure stability. Back up system configurations before applying changes. Monitor logs for any unusual activity during the transition period.
What to do and how to stay safe: Cisco
- Verify the current software version of all Cisco Expressway systems against the affected list.
- Download and install the latest software hardening release from Cisco's support portal.
- Review system logs for signs of exploitation attempts or unauthorized access.
- Restrict network access to Expressway management interfaces to trusted IP addresses only.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Cisco Expressway versions are affected by CVE-2026-76490?
Versions X8.11.2, X8.11.3, X8.6, and X8.2.2 of the Cisco TelePresence Video Communication Server (VCS) Expressway are affected.
Is there a patch available for this vulnerability?
Yes, Cisco has released software hardening updates that address the out-of-bounds write flaw in the affected versions.
What is the severity rating of CVE-2026-76490?
The National Vulnerability Database rates the severity as high, with a CVSS score of 8.6.
