cisco-sa-exwy-hardening-FhcqBVcs: Cisco Expressway Series Security Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching and streamline the disclosure process, Cisco has grouped these issues by their underlying vulnerability class - Common Weakness Enumeration (CWE) - and assigned a single Common Vulnerabilities and Exposures identifier (CVE ID) to each CWE grouping.Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.Note: Cisco may publish separate security advisories that provide additional details about individual vulnerabilities that are addressed in this release.Cisco has released a software update that addresses these vulnerabilities. There are no workarounds that address these vulnerabilities.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-exwy-hardening-FhcqBVcsThis advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.
Affected Software
Event History
Frequently Asked Questions
Which Cisco Expressway deployments are in scope?
The advisory applies to Cisco Expressway Series, including both Cisco Expressway Core (Expressway-C) and Cisco Expressway Edge (Expressway-E) devices.
Are these vulnerabilities known to be exploited in the wild?
No. Cisco states that the vulnerabilities were identified during internal testing and are not known to be actively exploited.
What can be done if the software update cannot be installed immediately?
Cisco states that there are no workarounds that address these vulnerabilities. Applying the released software update is the stated remediation.
Why might multiple issues be associated with a single CVE identifier?
Cisco grouped multiple internally discovered issues by their underlying Common Weakness Enumeration (CWE) class and assigned one CVE identifier to each CWE grouping. Separate advisories may later provide additional details for individual vulnerabilities addressed by the release.