Cisco Unified Communications Products: Cross-site scripting in web interface

Summary

CVE-2026-76475 groups cross-site scripting (CWE-79) issues in the web interfaces of several Cisco Unified Communications products: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection. An attacker can inject script code that runs in the browser of a user, typically an administrator logged into the web GUI, which can compromise the session and affect the system. The attack needs no login but requires that a victim interacts, for example by opening a crafted link. Cisco found the issues during internal testing and reports no known exploitation.

Affected

• Cisco Emergency Responder: releases 14 to 15SU4 as listed in the advisory
• Cisco Unified Communications Manager: releases 14 to 15SU2 and 15.0.1.13011-1 as listed in the advisory
• Cisco Unified CM IM&P: releases 14 to 15SU4 as listed in the advisory
• Cisco Unity Connection: releases 14 to 15SU4 as listed in the advisory
• Unified CM SME and Prime Collaboration Deployment: affected per the advisory
• Cisco states the products are affected regardless of device configuration

Fixed in

• Release 15: first fixed release is 15SU5
• Release 14: no fixed release named by Cisco; migrate to a fixed release as described in the advisory

Workaround

• None. Cisco states there are no workarounds; patching is the only remediation.

Exploitation

• Cisco is not aware of any public announcements or malicious use.
• Cisco and NHS England Digital state the issues are not known to be actively exploited.
• A third-party tracker reports no public exploit code and no CISA KEV listing (not checked directly).

Our recommendation

• Identify all affected Cisco Unified Communications systems and their release levels.
• Upgrade release 15 systems to 15SU5 and plan a migration of release 14 systems to a supported fixed release.
• Restrict access to web administration interfaces to management networks or VPN until patched.
• Ensure administrators do not browse untrusted links while logged into the web GUI.
• Check the current Cisco advisory (version 1.1) before acting and monitor for exploitation updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
• Cisco Emergency Responder 15SU5 Release Notes www.cisco.com
• NHS England Digital Cyber Alert CC-4877 digital.nhs.uk
• CVE-2026-76475 CVE record summary (threatint) cve.threatint.com
• Offseq threat summary for the Cisco hardening release radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:58.