{"id":"CVE-2026-76475","kind":"vulnerability","aliases":["CVE-2026-76475"],"related":[],"title":"Cisco Unified CM and Unity Connection: web page input flaws allow script injection","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.","summary":"Cisco Unified Communications Manager, Unity Connection and Emergency Responder have cross-site scripting flaws (CWE-79) in their web interfaces. An attacker who gets a crafted input into a page can run script in an administrator's browser session.","severity":"critical","cvss":9.3,"epss":0.0025,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Unified Communications Manager","fixed":["15SU5"],"affected":"14 (incl. SU1-SU3), 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Unity Connection","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Emergency Responder","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","emergency-responder","infrastructure","self-hosted","unified-cm","unity-connection","voip","xss"],"not_affected_if":[],"how_to_check":"Check the installed release on each of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection (CLI: show version active). Release 14 (incl. SU1 to SU3) and release 15 below 15SU5 are affected regardless of configuration.","fix":"Upgrade to 15SU5 or later. Release 14 has no fixed update: Cisco says to migrate to a fixed release. No workarounds.","status":"open","published_at":"2026-10-21T17:19:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:07+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:33:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 15SU5 or later for Unified CM, Unity Connection and Emergency Responder 15.x; for release 14 the sources do not name a fixed version.","reach":"network","title":"Cisco Unified CM and Unity Connection: web page input flaws allow script injection","impact":"medium","summary":"Cisco Unified Communications Manager, Unity Connection and Emergency Responder have cross-site scripting flaws (CWE-79) in their web interfaces. An attacker who gets a crafted input into a page can run script in an administrator's browser session.","category":"infrastructure","who_cares":["cisco","unified-cm","unity-connection","emergency-responder","self-hosted","voip"],"confidence":0.6,"needs_auth":"unknown","worst_case":"script runs in an admin browser session and can act as that admin","analyst_note":"Check the Cisco advisory (linked from the NVD entry) for the 14.x fixed release, the exact vulnerable pages, and whether authentication is required; the CVSS 9.3 score is unexplained by the XSS description alone.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000547,"input_tokens":3251,"output_tokens":443,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Cisco advisory (linked from the NVD entry) for the 14.x fixed release, the exact vulnerable pages, and whether authentication is required; the CVSS 9.3 score is unexplained by the XSS description alone.","search":"'-2026':15A,18A,165C '-76475':16A,19A,166C '-79':62B,191C 'address':155C 'administr':82B 'allow':11A 'attack':68B 'base':189C 'browser':84B 'cisco':1A,20A,24A,27A,30B,46B,89C,102C,105C,109C,115C,126C,137C 'cm':3A,40B,114C,123C,134C 'collabor':107C 'commit':92C 'common':185C 'communic':48B,111C,117C,128C 'communications':22A 'comprehens':143C 'concern':171C 'conduct':141C 'connect':6A,43B,51B,139C 'connection':26A 'craft':72B 'cross':57B 'cross-sit':56B 'cve':14A,17A,164C 'cwe':61B,188C,190C 'deploy':108C 'discov':158C 'edit':132C 'emerg':32B,53B,103C 'emergency':28A 'emergency-respond':31B 'engin':99C 'enumer':187C 'flaw':10A,60B 'generat':179C 'get':70B 'group':182C 'harden':152C 'host':37B 'im':119C,124C 'improp':172C 'infrastructur':34B 'inject':13A 'input':9A,73B,175C 'interfac':66B 'intern':144C,157C 'issu':170C 'manag':49B,112C,118C,129C,131C 'manager':23A 'multipl':156C 'neutral':173C 'ongo':91C 'p':125C 'page':8A,76B,178C 'part':87C 'presenc':120C 'prime':106C 'proactiv':94C 'product':97C 'qualiti':98C 'relat':168C 'releas':153C 'respond':33B,54B,104C 'responder':29A 'result':149C 'review':146C,148C 'run':78B 'script':12A,59B,79B 'secur':95C,145C 'self':36B 'self-host':35B 'servic':121C 'session':85B,130C 'site':58B 'sme':135C 'softwar':151C 'team':100C 'track':162C 'unifi':2A,39B,47B,110C,113C,116C,122C,127C,133C 'unified':21A 'unified-cm':38B 'uniti':5A,42B,50B,138C 'unity':25A 'unity-connect':41B 'voip':44B 'vulner':159C,161C 'weak':186C 'web':7A,65B,177C 'xss':45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76475","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76475","severity":null,"published_at":"2026-10-21T17:19:07+00:00","modified_at":"2026-10-22T14:17:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76475:228","url":null,"severity":null,"published_at":"2026-10-23T22:27:20+00:00","modified_at":"2026-10-23T22:27:20+00:00","first_seen_at":"2026-10-23T22:27:20+00:00","fetched_at":"2026-10-23T22:27:20+00:00","note":"Read Cisco advisory cisco-sa-voice-hardening-twgbH9e3 (grouped hardening release, CVE-2026-76475 = CWE-79 class, 9.3 per NVD/CVE record). Advisory gives no exact XSS interface or per-CVE auth detail; the CVSS vector in the CVE record (PR:N/UI:R/S:C) implies unauthenticated but needs user interaction. No exploitation known, no PoC. Release 14 has no fix: migrate. No workarounds."},{"source":"analyst","external_id":"CVE-2026-76475:310","url":null,"severity":null,"published_at":"2026-10-23T22:50:32+00:00","modified_at":"2026-10-23T22:50:32+00:00","first_seen_at":"2026-10-23T22:50:32+00:00","fetched_at":"2026-10-23T22:50:32+00:00","note":"No new sources since run 228; restoring how-to-check and fix that the triage rewrite blanked. Source: Cisco advisory cisco-sa-voice-hardening-twgbH9e3. Auth and user interaction not stated in the advisory; the CVE record vector (PR:N/UI:R/S:C) implies no login but a user must load the injected content."},{"source":"epss","external_id":"CVE-2026-76475","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76475","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1444,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html","title":"Cisco Unified Communications Products Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}