CVE-2026-76477: Cisco Unified Communications SQL injection in

CVE-2026-76477 · Severity: high · CVSS 8.8 · Published 2026-10-21

Cisco's unified communications platform, which manages business phone systems and instant messaging across enterprises, contains an SQL injection vulnerability that could allow attackers to read or modify the database storing call logs, user credentials, and network routing configurations. An attacker on the network with no authentication required could exploit this to gain complete access to the communications infrastructure, affecting call routing, user authentication, and message handling across the organization.

Technologies: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-76477 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76477 being exploited in the wild.
How severe is CVE-2026-76477?
High severity, with a CVSS score of 8.8, published 21 October 2026.
Which products and versions are affected?
Cisco Emergency Responder 14 and prior; 15 prior to 15SU5; Cisco Prime Collaboration Deployment 14 and prior; 15 prior to 15SU5; Cisco Unified Communications Manager 14 and prior; 15 prior to 15SU5; Cisco Unified Communications Manager IM & Presence Service 14 and prior; 15 prior to 15SU5; and 2 more.
Is there a fix for CVE-2026-76477?
Yes: fixed in 15SU5 (all affected products); customers on release 14 must migrate to a fixed release. Until then: No workarounds are available; immediate upgrade to the patched version is required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76477 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76477?
Check whether you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 15SU5 (all affected products); customers on release 14 must migrate to a fixed release

No workarounds are available; immediate upgrade to the patched version is required.

Technical details

CVE-2026-76477 is one of eight vulnerabilities in a hardening release covering improper neutralization of SQL commands (CWE-89) across multiple Cisco unified communications products. The vulnerability can be exploited remotely over the network without authentication or user interaction (CVSS vector: AV:N/AC:L/PR:N/UI:N). Exploitation allows an attacker to execute arbitrary SQL commands against the affected product databases.

Affected products

  • Cisco Emergency Responder 14 and prior; 15 prior to 15SU5
  • Cisco Prime Collaboration Deployment 14 and prior; 15 prior to 15SU5
  • Cisco Unified Communications Manager 14 and prior; 15 prior to 15SU5
  • Cisco Unified Communications Manager IM & Presence Service 14 and prior; 15 prior to 15SU5
  • Cisco Unified Communications Manager Session Management Edition 14 and prior; 15 prior to 15SU5
  • Cisco Unity Connection 14 and prior; 15 prior to 15SU5

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.