Cisco Unified Communications Products: Path traversal in hardening release

Summary

Several Cisco voice and unified communications products, including Unified CM, Unity Connection, Emergency Responder and IM and Presence Service, contain a path traversal flaw (CWE-22). An attacker with a valid low-privileged local account can access files outside a restricted directory. Because the CVSS vector requires local access and low privileges, the flaw is not directly reachable from the internet, but a successful attack could affect confidentiality, integrity and availability.

Affected

• Cisco Emergency Responder, Unified CM, Unified CM IM and Presence Service and Unity Connection, releases 14 and 15 (per the CVE record; exact build list in the Cisco advisory)
• Prime Collaboration Deployment and Unified CM SME are listed as vulnerable products in the Cisco advisory
• Affected regardless of device configuration

Fixed in

• Release 15: fixed in 15SU5
• Release 14: no fixed release; Cisco advises migration to a fixed release
• Verify the per-product build list in the Cisco advisory before patching

Workaround

• None. Cisco states that no workarounds are available.
• General hardening, not Cisco guidance: restrict local and low-privileged access to the servers and review administrator account use until patched.

Exploitation

• Cisco is not aware of public announcements or malicious use.
• CISA SSVC data: exploitation none, automatable no, technical impact total.
• No public proof of concept found in the research; this does not rule one out.

Our recommendation

• Inventory all Unified CM, Unity Connection, IM and Presence and Emergency Responder systems and identify their release.
• Prioritise migration of release 14 systems, because no fixed 14 release exists.
• Schedule upgrades of release 15 systems to 15SU5 or later, ideally together with the other CVEs in the same Cisco advisory.
• Limit local and low-privileged accounts and monitor for unusual file access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cisco Security Advisory cisco-sa-voice-hardening-twgbH9e3 sec.cloudapps.cisco.com
• Cisco Security Advisory (public page) www.cisco.com
• OpenCVE CVE-2026-76479 app.opencve.io
• Neoteo: Cisco Unified CM advisory, eight CVEs and fixes www.neoteo.com
• Rescana: Cisco Unified Communications hardening release October 2026 www.rescana.com
• SecurityOnline: Cisco Unified CM vulnerabilities hardening securityonline.info
• Threatint CVE-2026-76479 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:50.