CVE-2026-76479: Cisco Unified Communications Products path traversal in security hardening

CVE-2026-76479 · Severity: high · CVSS 7.8 · Published 2026-10-21

Cisco's unified communications platforms—which handle enterprise phone systems, messaging, and collaboration—contain multiple path traversal and input validation flaws discovered during internal security review. An unauthenticated attacker on the network could exploit these to access restricted files, bypass authentication, inject SQL commands, or perform other attacks that compromise confidentiality and availability of communications infrastructure.

Technologies: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-76479 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76479 being exploited in the wild.
How severe is CVE-2026-76479?
High severity, with a CVSS score of 7.8, published 21 October 2026.
Which products and versions are affected?
Cisco Emergency Responder; Cisco Prime Collaboration Deployment; Cisco Unified Communications Manager; Cisco Unified Communications Manager IM & Presence Service; and 2 more.
Is there a fix for CVE-2026-76479?
Yes: fixed in Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection: Release 15SU5 and later; Release 14 requires migration to a fixed release.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76479 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76479?
Check whether you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection: Release 15SU5 and later; Release 14 requires migration to a fixed release.

Technical details

This advisory groups multiple vulnerability classes (CWE-22, CWE-20, CWE-74, CWE-79, CWE-89, CWE-284, CWE-287, CWE-703) across six Cisco communication products. The highest-impact flaws (CVSS 9.8) include improper resource lifetime control and authentication bypasses; CVE-2026-76479 specifically addresses path traversal allowing directory escape. All are internally discovered, not known to be exploited in the wild, and require network access with no authentication or user interaction.

Affected products

  • Cisco Emergency Responder
  • Cisco Prime Collaboration Deployment
  • Cisco Unified Communications Manager
  • Cisco Unified Communications Manager IM & Presence Service
  • Cisco Unified Communications Manager Session Management Edition
  • Cisco Unity Connection

Timeline

  • 2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.