CVE-2026-76419 · Vendor
NO FIX YET
The web management interface of Cisco Unified Communications Manager and Unified CM SME does not validate user input properly. An attacker who tricks a user into clicking a crafted link can run script in that user's browser and read browser-based information.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organizations running Cisco Unified Communications Manager or Unified CM Session Management Edition with the web-based management interface reachable by staff. The sources do not state affected versions or which configurations are exposed. unknown for anything beyond that.
Not affected if auth-required
Who cares cisco, self-hosted, unified-cm, voip
Unknown from the sources.
No fix yet, per the sources.
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
This page as .md · .json · in your agent: get_signal("CVE-2026-76419") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.