CVE-2026-76494: Improper Control of Generation of Code ('Code Injection') in Cisco Cisco TelePresence Video Communication Server (VCS) Expressway

This vulnerability concerns improper control of code generation in Cisco TelePresence VCS Expressway, categorized under CWE-94 (Code Injection). It was discovered internally by Cisco's engineering team during a security review, resulting in software hardening releases. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that an attacker with local access and low privileges can exploit the vulnerability without user interaction, potentially causing high impact on confidentiality, integrity, and availability. No explicit affected versions or patch details are provided in the source data.

The vulnerability allows an attacker with local access and low privileges to perform code injection, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could enable unauthorized code execution and control over the Cisco TelePresence VCS Expressway device.

The input data does not provide explicit patch or remediation information. Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Cisco has indicated software hardening releases addressing multiple vulnerabilities including this one, so applying the latest updates from Cisco is recommended once available.