CVE-2026-76474: Cisco Unified Communications authentication bypass

CVE-2026-76474 · Severity: critical · CVSS 9.8 · Published 2026-10-21

Cisco's unified communications platform—which manages voice, messaging, and real-time collaboration for enterprises—contains multiple authentication and input validation flaws grouped under CVE-2026-76474. An unauthenticated remote attacker can exploit these vulnerabilities to bypass authentication, gain unauthorized access to the system, and potentially take control of communications infrastructure. No known workarounds exist; patching is required.

Technologies: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-76474 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76474 being exploited in the wild.
How severe is CVE-2026-76474?
Critical severity, with a CVSS score of 9.8, published 21 October 2026.
Which products and versions are affected?
Cisco Emergency Responder Release 14 and earlier (affected); 15SU5+ (fixed); Cisco Prime Collaboration Deployment Release 14 and earlier (affected); 15SU5+ (fixed); Cisco Unified Communications Manager Release 14 and earlier (affected); 15SU5+ (fixed); Cisco Unified Communications Manager IM & Presence Service Release 14 and earlier (affected); 15SU5+ (fixed); and 2 more.
Is there a fix for CVE-2026-76474?
Yes: fixed in Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection: 15SU5 and later (Release 14 requires migration). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76474 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76474?
Check whether you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection: 15SU5 and later (Release 14 requires migration)

Technical details

CVE-2026-76474 tracks improper authentication vulnerabilities (CWE-287) within Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. The vulnerability is remotely exploitable without authentication or user interaction; an attacker gains complete confidentiality, integrity, and availability impact on the affected products. Patches are available in Emergency Responder/Prime Collaboration Deployment/Unified CM version 15SU5 and later; Release 14 versions require migration to fixed releases.

Affected products

  • Cisco Emergency Responder Release 14 and earlier (affected); 15SU5+ (fixed)
  • Cisco Prime Collaboration Deployment Release 14 and earlier (affected); 15SU5+ (fixed)
  • Cisco Unified Communications Manager Release 14 and earlier (affected); 15SU5+ (fixed)
  • Cisco Unified Communications Manager IM & Presence Service Release 14 and earlier (affected); 15SU5+ (fixed)
  • Cisco Unified Communications Manager Session Management Edition Release 14 and earlier (affected); 15SU5+ (fixed)
  • Cisco Unity Connection Release 14 and earlier (affected); 15SU5+ (fixed)

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.