CVE-2026-76495: Incorrect Permission Assignment for Critical Resource in Cisco Cisco TelePresence Video Communication Server (VCS) Expressway

Cisco identified multiple internally discovered vulnerabilities through a comprehensive internal security review of the Cisco Expressway Series software. CVE-2026-76495 concerns incorrect permission assignments for critical resources, classified under CWE-732. This flaw could allow an attacker with limited privileges to gain unauthorized access or perform unauthorized actions affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, and unchanged scope with high impact on all three security properties.

The vulnerability allows unauthorized access or modification of critical resources due to incorrect permission assignments. This can lead to full compromise of confidentiality, integrity, and availability of the affected system components. However, exploitation requires local access with low privileges, and no known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or workaround information is provided, users should monitor Cisco's official advisories for updates and apply any released software hardening updates promptly.