Is CVE-2026-76487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76487 being exploited in the wild.

How severe is CVE-2026-76487?

Medium severity, with a CVSS score of 5.3, published 21 October 2026.

Which products and versions are affected?

Cisco Unified Communications Manager 14, 15 prior to 15SU5; Cisco Unified Communications Manager Session Management Edition 14, 15 prior to 15SU5.

How is CVE-2026-76487 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76487?

Check whether you run Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76487: Cisco Unified Communications Manager access control bypass

CVE-2026-76487 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Cisco Unified Communications Manager is a voice and video conferencing platform used to manage enterprise communications. An unauthenticated attacker can exploit improper input validation in HTTP requests to bypass access controls and access network segments beyond their intended permissions. While no active exploitation has been reported, this could enable lateral movement or unauthorized access to sensitive communications infrastructure.

Technologies: Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition. Vendors: Cisco.

Quick answers

Is CVE-2026-76487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76487 being exploited in the wild.
How severe is CVE-2026-76487?: Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?: Cisco Unified Communications Manager 14, 15 prior to 15SU5; Cisco Unified Communications Manager Session Management Edition 14, 15 prior to 15SU5.
Is there a fix for CVE-2026-76487?: Yes: fixed in Unified Communications Manager 15SU5; for version 14, migrate to a fixed release. Until then: No workarounds are available; upgrading to the fixed software release is required to remediate this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76487 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76487?: Check whether you run Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Unified Communications Manager 15SU5; for version 14, migrate to a fixed release

No workarounds are available; upgrading to the fixed software release is required to remediate this vulnerability.

Technical details

The vulnerability stems from improper input validation in specific HTTP requests to Unified CM and Unified CM SME. An unauthenticated remote attacker can send a crafted HTTP request to bypass access controls (CWE-749), allowing access to network segments beyond the attacker's intended scope. The attack requires only network connectivity and involves no user interaction or authentication.

Affected products

Cisco Unified Communications Manager 14, 15 prior to 15SU5
Cisco Unified Communications Manager Session Management Edition 14, 15 prior to 15SU5

Timeline

2026-10-21: disclosed

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.