CVE-2026-76496: Improper Link Resolution Before File Access ('Link Following') in Cisco Cisco TelePresence Video Communication Server (VCS) Expressway

CVE-2026-76496 concerns improper link resolution before file access ('link following') in Cisco TelePresence Video Communication Server (VCS) Expressway. The issue falls under CWE-59, indicating a weakness in how symbolic links or similar references are resolved prior to accessing files, potentially leading to unauthorized file access or modification. The vulnerability was discovered internally by Cisco and addressed through software hardening releases, although no explicit patch or affected version information is provided in the current data.

The vulnerability has a CVSS 3.1 score of 7.0 (high severity) with attack vector local (AV:L), requiring high attack complexity (AC:H), low privileges (PR:L), and no user interaction (UI:N). Successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at this time.

Cisco has conducted internal security reviews and implemented software hardening releases to address this vulnerability. However, no explicit patch or remediation details are provided in the available data. Users should consult Cisco's official advisories for specific patch availability and remediation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.