Cisco Unified Communications Products: Improper neutralization of special elements in output
Summary
Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection contain a vulnerability in the October 2026 hardening release, grouped under CWE-74 (improper neutralization of special elements in output used by a downstream component). Cisco rates it critical (CVSS 9.8) and states it is network-reachable without privileges or user interaction, with high impact on confidentiality, integrity and availability. Cisco has not disclosed technical details, and the exact bug class is still under clarification, so the exact attack path is unknown.
Affected
- Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection (affected regardless of device configuration)
- Release 14 and 15 branches are listed as affected in the advisory's tables; exact affected builds: verify in the Cisco Fixed Software section
- Unified CM 15.0.1.13010-1 and 15.0.1.13011-1 are listed as affected
Fixed in
- Release 15: 15SU5 (verify in the Cisco Fixed Software section)
- Release 14: no fixed release named; migrate to a fixed release as stated by Cisco
Workaround
Unknown. Cisco states there are no workarounds that address these vulnerabilities. Patching is the only real fix; network segmentation and restricting access to management and call-control interfaces reduce exposure.
Exploitation
- Cisco PSIRT is not aware of public announcements or malicious use.
- Found during internal testing; CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public proof-of-concept found in the sources reviewed.
Our recommendation
- Identify all Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment systems and check whether they or their management ports are reachable from the internet.
- Patch to the fixed release in the Cisco advisory (15SU5 for release 15) as a priority, testing call flows before rollout.
- Plan a migration for release 14 systems.
- Monitor for public proof-of-concept code and updates to the advisory and NVD entry.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
- Cisco advisory (alternate URL) www.cisco.com
- NHS England cyber alert CC-4877 digital.nhs.uk
- OpenCVE CVE-2026-76473 app.opencve.io
- Vulners Cisco advisory summary vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:07.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper neutralization of special elements in output used by a downstream component that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.