Cisco Unified Communications Products: Improper access control

Summary

Several Cisco Unified Communications products, including Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection and Emergency Responder, contain improper access control flaws grouped under CVE-2026-76478 (CWE-284). An attacker with local access and a low-privilege account may bypass access controls, with a changed scope and high impact on confidentiality, integrity and availability. Cisco reports no workarounds and no known exploitation.

Affected

• Cisco Emergency Responder
• Cisco Prime Collaboration Deployment
• Cisco Unified Communications Manager (Unified CM)
• Cisco Unified Communications Manager IM and Presence Service (Unified CM IM&P)
• Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
• Cisco Unity Connection
• Exact affected versions: Unknown. Verify against the Affected Products table in the Cisco advisory.

Fixed in

• Cisco's Fixed Software table lists 15SU5 as the first fixed release. Verify the fixed release for each product and release train in the Cisco advisory.

Workaround

• None. Cisco states that there are no workarounds for these vulnerabilities.

Exploitation

• Cisco PSIRT is not aware of any public announcements or malicious use.
• CISA SSVC: exploitation none, not automatable, technical impact total.

Our recommendation

• Inventory all Cisco Unified Communications systems and confirm running versions against the Cisco advisory.
• Plan the upgrade to a fixed release in the next scheduled maintenance window. Upgrade instead of patching where a train is end-of-support.
• Keep management interfaces off the internet and restrict administrative and operating system access to trusted staff.
• Review low-privilege accounts and monitor voice servers for unusual logins or changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
• Cisco Security Advisory (cisco.com mirror) www.cisco.com
• OpenCVE: CVE-2026-76478 app.opencve.io
• VulDB: CVE-2026-76478 vuldb.com
• SecurityOnline: Cisco Unified CM hardening vulnerabilities securityonline.info
• NHS Digital cyber alert CC-4877 digital.nhs.uk

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:11.