Is CVE-2026-76438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76438 being exploited in the wild.

How severe is CVE-2026-76438?

Medium severity, with a CVSS score of 6.5, published 16 September 2026.

Which products and versions are affected?

Cisco BroadWorks Application Server 24.0 (before patch AP.as.24.0.944.ap385770), 25.0–26.x, 27.0 (before 27.0.2026.08); Cisco BroadWorks CommPilot Application Software 23.0, 24.0 (before 24.0.2026.07), 25.0, 26.0, 27.0 (before 27.0.2026.08).

Is there a fix for CVE-2026-76438?

A patch was published on 2026-09-16: Fixed releases available: CommPilot 24.0.2026.07, 27.0.2026.08; Application Server patch AP.as.24.0.944.ap385770 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76438 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76438?

Check whether you run Cisco BroadWorks Application Server or Cisco BroadWorks CommPilot Application Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76438: Cisco BroadWorks CommPilot authorization bypass in web management interface

CVE-2026-76438 · Severity: medium · CVSS 6.5 · Published 2026-09-16

Cisco BroadWorks CommPilot is a web-based management and communication application used by enterprises. A missing authorization check in the management interface allows authenticated users with low privileges to modify system configurations they should not have access to, potentially disrupting service or gaining unauthorized control over communication settings.

Vendors: Cisco.

Quick answers

Is CVE-2026-76438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76438 being exploited in the wild.
How severe is CVE-2026-76438?: Medium severity, with a CVSS score of 6.5, published 16 September 2026.
Which products and versions are affected?: Cisco BroadWorks Application Server 24.0 (before patch AP.as.24.0.944.ap385770), 25.0–26.x, 27.0 (before 27.0.2026.08); Cisco BroadWorks CommPilot Application Software 23.0, 24.0 (before 24.0.2026.07), 25.0, 26.0, 27.0 (before 27.0.2026.08).
Is there a fix for CVE-2026-76438?: A patch was published on 2026-09-16: Fixed releases available: CommPilot 24.0.2026.07, 27.0.2026.08; Application Server patch AP.as.24.0.944.ap385770 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76438 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76438?: Check whether you run Cisco BroadWorks Application Server or Cisco BroadWorks CommPilot Application Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a missing authorization check (CWE-863) in the web-based management interface of Cisco BroadWorks CommPilot Application Software. An authenticated attacker with low privileges can craft and send HTTP requests to bypass authorization checks and alter configurations on select administrative pages. The vulnerability requires authentication to exploit, but grants unauthorized modification capability to an already-authenticated user. Cisco has released software fixes for affected versions (24.0.2026.07, 27.0.2026.08, and patches for earlier versions) and notes there are no workarounds available.

Affected products

Cisco BroadWorks CommPilot Application Software 23.0, 24.0 (before 24.0.2026.07), 25.0, 26.0, 27.0 (before 27.0.2026.08)
Cisco BroadWorks Application Server 24.0 (before patch AP.as.24.0.944.ap385770), 25.0–26.x, 27.0 (before 27.0.2026.08)

Timeline

2026-09-16: disclosed: Advisory published by Cisco PSIRT
2026-09-16: patched: Fixed releases available: CommPilot 24.0.2026.07, 27.0.2026.08; Application Server patch AP.as.24.0.944.ap385770

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-auth-bypass-broadwor-57m9dmm5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.