Cisco Unified Communications Products: Improper input validation
Summary
Several Cisco Unified Communications products, including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, are affected by an improper input validation flaw (CWE-20). Cisco does not describe the specific flaw publicly. The CVSS 3.1 score of 8.8 indicates that an attacker with low privileges could exploit it remotely over the network without user interaction, with high impact on confidentiality, integrity and availability. Cisco states that the products are affected regardless of device configuration.
Affected
- Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM and Presence Service, Unified CM SME and Unity Connection
- Release 14 and release 15 builds as listed in the Cisco advisory (exact build list not reproduced here)
Fixed in
- Release 15: fixed in 15SU5
- Release 14: migrate to a fixed release as stated in the Cisco advisory
Workaround
- None available according to Cisco.
Exploitation
- Cisco PSIRT is not aware of any public announcements or malicious use.
- Cisco states the issue was found during internal testing.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory all Cisco Unified Communications servers and their release and SU level.
- Upgrade release 15 systems to 15SU5 and plan migration off release 14.
- Restrict access to administration web interfaces to management networks and review administrator accounts.
- Monitor the Cisco advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
- Cisco Security Advisory (cisco.com copy) www.cisco.com
- OpenCVE CVE-2026-76476 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:12.
Original description (NVD)
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.