CVE-2026-76497: Insecure Temporary File in Cisco Cisco TelePresence Video Communication Server (VCS) Expressway

This vulnerability concerns insecure temporary file handling in Cisco TelePresence Video Communication Server (VCS) Expressway, identified as CVE-2026-76497. It falls under CWE-377, which involves the use of insecure temporary files that can lead to security risks. Cisco's internal security review led to software hardening releases addressing this and other vulnerabilities. The CVSS 3.1 score is 6.6 (medium severity) with attack vector local, low attack complexity, low privileges required, user interaction required, and impacts on integrity and availability but not confidentiality. No explicit affected versions or patch information is provided in the source data.

The vulnerability allows an attacker with local access and low privileges, requiring user interaction, to exploit insecure temporary file handling, potentially impacting system integrity and availability. Confidentiality is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Cisco has indicated that software hardening releases addressing this vulnerability exist, but no explicit patch or version information is provided. Users should monitor Cisco advisories for updates and apply any official fixes when available.