Cisco Unified CM and Unity Connection: web page input flaws allow script injection

1. NVD2026-10-23 21:57 UTC · published 2026-10-21 17:19 UTC · CVE-2026-76475
2. InfraStack analyst2026-10-23 22:27 UTC · published 2026-10-23 22:27 UTC
   “Read Cisco advisory cisco-sa-voice-hardening-twgbH9e3 (grouped hardening release, CVE-2026-76475 = CWE-79 class, 9.3 per NVD/CVE record). Advisory gives no exact XSS interface or per-CVE auth detail; the CVSS vector in the CVE record (PR:N/UI:R/S:C) implies unauthenticated but needs user interaction. No exploitation known, no PoC. Release 14 has no fix: migrate. No workarounds.”
3. InfraStack analyst2026-10-23 22:50 UTC · published 2026-10-23 22:50 UTC
   “No new sources since run 228; restoring how-to-check and fix that the triage rewrite blanked. Source: Cisco advisory cisco-sa-voice-hardening-twgbH9e3. Auth and user interaction not stated in the advisory; the CVE record vector (PR:N/UI:R/S:C) implies no login but a user must load the injected content.”
4. EPSS2026-10-24 13:15 UTC · CVE-2026-76475

Each row is the first time that source carried this signal. The analyst’s rows are its own findings.

• NVD: CVE-2026-76475 · 10-23 21:57
• EPSS: CVE-2026-76475 · 10-24 13:15
• Cisco Unified Communications Products Security Hardening Release: October 2026Advisory · InfraStack analyst

This page as .md · .json · in your agent: get_signal("CVE-2026-76475")

NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.