CVE-2026-76478: Cisco Unified Communications Products improper access control

CVE-2026-76478 · Severity: high · CVSS 8.8 · Published 2026-10-21

Cisco's unified communications platform, which manages enterprise phone systems and messaging, contains multiple improper access control and input validation vulnerabilities discovered during internal security review. An unauthenticated network attacker could exploit these flaws to gain unauthorized access to sensitive data, modify system configuration, or disrupt communications services. No active exploitation has been reported.

Technologies: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-76478 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76478 being exploited in the wild.
How severe is CVE-2026-76478?
High severity, with a CVSS score of 8.8, published 21 October 2026.
Which products and versions are affected?
Cisco Emergency Responder 14 and earlier; Cisco Prime Collaboration Deployment 14 and earlier; Cisco Unified Communications Manager 14 and earlier; Cisco Unified Communications Manager IM & Presence Service 14 and earlier; and 2 more.
Is there a fix for CVE-2026-76478?
Yes: fixed in Release 15 SU5 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76478 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76478?
Check whether you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Release 15 SU5 and later

Technical details

CVE-2026-76478 and related CVEs address multiple vulnerability classes (CWE-284 access control, CWE-287 authentication, CWE-20 input validation, CWE-89 SQL injection, CWE-79 XSS, and others) in Cisco's unified communications suite. The vulnerabilities are unauthenticated network-reachable with no user interaction required, affecting Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Patches are available in Release 15 SU5 and later.

Affected products

  • Cisco Emergency Responder 14 and earlier
  • Cisco Prime Collaboration Deployment 14 and earlier
  • Cisco Unified Communications Manager 14 and earlier
  • Cisco Unified Communications Manager IM & Presence Service 14 and earlier
  • Cisco Unified Communications Manager Session Management Edition 14 and earlier
  • Cisco Unity Connection 14 and earlier

Timeline

  • 2026-10-21: disclosed
  • 2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.