Cisco Unified Communications Products: Improper authentication vulnerability
Summary
Cisco Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME and Unity Connection are affected by a critical improper authentication flaw (CWE-287). CVE-2026-76474 groups several internally found issues in this class, including authentication bypasses, session fixation, spoofing and capture-replay; the CVSS score reflects the worst case within this group. An unauthenticated attacker with network access to a reachable interface could potentially cause high impact on confidentiality, integrity and availability. Cisco reports no workarounds and no known exploitation.
Affected
- Cisco Emergency Responder: 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, 15SU1a, 14SU4, 15SU2, 15SU3, 14SU5\n- Unified CM: 14, 14SU1, 14SU2, 14SU3, 15, 15SU1, 14SU4, 14SU4a, 15SU1a, 15SU2, 15.0.1.13010-1, 15.0.1.13011-1\n- Unified CM IM&P: 14, 14SU1, 14SU2, 14SU2a, 14SU3, 15, 15SU1, 14SU4, 15SU2, 15SU3, 14SU5, 15SU4\n- Unity Connection: 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, 14SU4, 15SU2, 15SU3, 14SU5, 15SU4\n- Prime Collaboration Deployment and Unified CM SME: affected releases not listed in the reviewed sources\n- Default configuration: unknown
Fixed in
- Release 15: 15SU5 (first fixed release per Cisco advisory)\n- Release 14: migrate to a fixed release; the exact target per product is not confirmed in the reviewed sources\n- Other releases and products: unknown, check the Fixed Software section of the advisory
Workaround
- Cisco states that no workarounds are available.\n- Reduce exposure by restricting management and call-control interfaces to trusted networks.
Exploitation
- The Cisco PSIRT is not aware of public announcements or malicious use.\n- The vulnerabilities were found during internal testing. No public proof-of-concept was identified in the reviewed sources.\n- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all Unified Communications systems with exact release numbers.\n- Upgrade Release 15 systems to 15SU5 or later; plan a migration for Release 14 systems.\n- Check whether admin, SIP or other interfaces are internet-reachable and restrict them to trusted networks.\n- Monitor for anomalous logins and authentication events.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
- Cisco advisory (public mirror) www.cisco.com
- OpenCVE CVE-2026-76474 app.opencve.io
- Neoteo: Cisco Unified CM advisory summary www.neoteo.com
- SecurityOnline: Cisco Unified CM hardening vulnerabilities securityonline.info
- Rescana: Cisco Unified Communications hardening October 2026 www.rescana.com
- Safeguard: Unified CM 15SU5 October 2026 safeguard.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:06.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.