Cisco Unified Communications Products: SQL injection in multiple UC components

Summary

Several Cisco Unified Communications products, including Unified CM, Unified CM IM and Presence, Unified CM SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment, contain an SQL injection flaw (CWE-89) fixed in Cisco's October 2026 hardening release. CVE-2026-76477 is a grouping CVE for one or more internally found bugs, scored by Cisco at CVSS 8.8. An attacker with a low-privilege account on the network could read, change or delete data and disrupt the system, without user interaction. Cisco states that no workarounds exist, and no public exploitation is known.

Affected

• Cisco Emergency Responder, Unified Communications Manager, Unified CM IM and Presence Service and Unity Connection, across Release 14 and Release 15 software updates listed in the CVE record
• Prime Collaboration Deployment and Unified CM SME are listed as affected in Cisco's advisory
• Exact affected builds: to be verified against the Affected Products section of Cisco's advisory

Fixed in

• Release 15: 15SU5 (first fixed release per Cisco's advisory table)
• Release 14: migrate to a fixed release; the exact target is not confirmed in the available excerpts

Workaround

Unknown. Cisco states that there are no workarounds that address these vulnerabilities. Patching is the only fix.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• Not listed in the CISA KEV catalog at the time of research.

Our recommendation

• Inventory all Cisco UC nodes (Unified CM, IM and Presence, SME, Unity Connection, Emergency Responder, Prime Collaboration Deployment) with their versions and SU levels.
• Check Cisco's advisory for the exact fixed build per product.
• Plan the upgrade to 15SU5 for Release 15 and migrate Release 14 systems to a fixed release.
• Until patched, restrict admin and web access to trusted networks and remove unnecessary low-privilege accounts. This reduces exposure but is not a Cisco-documented fix.
• Patch the whole October 2026 bundle together, including the other CVEs in this advisory.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
• Cisco Security Advisory (cisco.com docs version) www.cisco.com
• OpenCVE: CVE-2026-76477 app.opencve.io
• NHS England cyber alert CC-4877 digital.nhs.uk
• Cisco Emergency Responder series documentation www.cisco.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:12.