---
id: "CVE-2026-76475"
kind: "vulnerability"
aliases: ["CVE-2026-76475"]
title: "Cisco Unified CM and Unity Connection: web page input flaws allow script injection"
severity: "critical"
cvss: 9.3
epss: 0.0025
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Unified Communications Manager", "fixed": ["15SU5"], "affected": "14 (incl. SU1-SU3), 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Unity Connection", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Emergency Responder", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "emergency-responder", "infrastructure", "self-hosted", "unified-cm", "unity-connection", "voip", "xss"]
not_affected_if: []
published_at: "2026-10-21T17:19:07+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76475", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:27:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:50:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76475", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Cisco Unified CM and Unity Connection: web page input flaws allow script injection

Cisco Unified Communications Manager, Unity Connection and Emergency Responder have cross-site scripting flaws (CWE-79) in their web interfaces. An attacker who gets a crafted input into a page can run script in an administrator's browser session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Unified Communications Manager affected 14 (incl. SU1-SU3), 15 < 15SU5 fixed 15SU5
- vendor:Cisco Unity Connection affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Emergency Responder affected 14, 15 < 15SU5 fixed 15SU5

## How to check

Check the installed release on each of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection (CLI: show version active). Release 14 (incl. SU1 to SU3) and release 15 below 15SU5 are affected regardless of configuration.

## Fix

Upgrade to 15SU5 or later. Release 14 has no fixed update: Cisco says to migrate to a fixed release. No workarounds.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76475
- 2026-10-23T22:27:20+00:00 analyst — Read Cisco advisory cisco-sa-voice-hardening-twgbH9e3 (grouped hardening release, CVE-2026-76475 = CWE-79 class, 9.3 per NVD/CVE record). Advisory gives no exact XSS interface or per-CVE auth detail; the CVSS vector in the CVE record (PR:N/UI:R/S:C) implies unauthenticated but needs user interaction. No exploitation known, no PoC. Release 14 has no fix: migrate. No workarounds.
- 2026-10-23T22:50:32+00:00 analyst — No new sources since run 228; restoring how-to-check and fix that the triage rewrite blanked. Source: Cisco advisory cisco-sa-voice-hardening-twgbH9e3. Auth and user interaction not stated in the advisory; the CVE record vector (PR:N/UI:R/S:C) implies no login but a user must load the injected content.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76475

## Documents

- [advisory] Cisco Unified Communications Products Security Hardening Release: October 2026 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_