CVE-2026-76476: Cisco Unified Communications Products improper input validation

CVE-2026-76476 · Severity: high · CVSS 8.8 · Published 2026-10-21

Cisco's voice communication platforms—used to manage enterprise phone systems and messaging—contain multiple improper input validation flaws discovered during internal security review. An unauthenticated attacker on the network could exploit these vulnerabilities to gain unauthorized access, modify data, or cause service outages affecting business communications.

Technologies: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-76476 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76476 being exploited in the wild.
How severe is CVE-2026-76476?
High severity, with a CVSS score of 8.8, published 21 October 2026.
Which products and versions are affected?
Cisco Emergency Responder Release 14 and earlier; fixed in migrated releases; Cisco Prime Collaboration Deployment Release 14 and earlier; fixed in migrated releases; Cisco Unified Communications Manager Release 14 and earlier; fixed in migrated releases; Cisco Unified Communications Manager IM & Presence Service Release 14 and earlier; fixed in migrated releases; and 2 more.
Is there a fix for CVE-2026-76476?
Yes: fixed in Release 15SU5 for Unified CM, Unified CM IM&P, Unified CM SME, Emergency Responder, Prime Collaboration Deployment, and Unity Connection; Release 14 users must migrate to a fixed release. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76476 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76476?
Check whether you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Release 15SU5 for Unified CM, Unified CM IM&P, Unified CM SME, Emergency Responder, Prime Collaboration Deployment, and Unity Connection; Release 14 users must migrate to a fixed release

Technical details

CVE-2026-76476 is one of eight vulnerabilities grouped by CWE class and discovered in Cisco's unified communications products during an internal security audit. The improper input validation issues (CWE-20) allow network-based attacks with no authentication or user interaction required. The advisory indicates these are part of a broader hardening initiative addressing multiple weakness classes including authentication bypass (CWE-287), SQL injection (CWE-89), and path traversal (CWE-22).

Affected products

  • Cisco Emergency Responder Release 14 and earlier; fixed in migrated releases
  • Cisco Prime Collaboration Deployment Release 14 and earlier; fixed in migrated releases
  • Cisco Unified Communications Manager Release 14 and earlier; fixed in migrated releases
  • Cisco Unified Communications Manager IM & Presence Service Release 14 and earlier; fixed in migrated releases
  • Cisco Unified Communications Manager Session Management Edition Release 14 and earlier; fixed in migrated releases
  • Cisco Unity Connection Release 14 and earlier; fixed in migrated releases

Timeline

  • 2026-10-21: disclosed
  • 2026-10-21: advisory: Cisco security advisory cisco-sa-voice-hardening-twgbH9e3 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.