{"id":"CVE-2026-76476","kind":"vulnerability","aliases":["CVE-2026-76476"],"related":[],"title":"Cisco Unified CM and Unity Connection: input validation flaws, CVSS 8.8","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;\r\n\r\nThe vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.","summary":"Cisco's October 2026 hardening release for Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment fixes a group of improper input validation (CWE-20) flaws. The 8.8 score is the worst single flaw in the group: network-reachable, low complexity, needs a low-privilege account, high impact on confidentiality, integrity and availability. Cisco found them internally, says they are not exploited, and offers no workarounds. Affected regardless of configuration.","severity":"high","cvss":8.8,"epss":0.00338,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Unified Communications Manager","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Unity Connection","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Unified CM IM&P","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Unified CM SME","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Emergency Responder","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"},{"name":"Cisco Prime Collaboration Deployment","fixed":["15SU5"],"affected":"14, 15 < 15SU5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","self-hosted","unified-cm","unity-connection","vendor","voice"],"not_affected_if":["managed-hosting"],"how_to_check":"Check your product version (Cisco admin UI or CLI 'show version active'). Release 14 (any SU) and 15 before 15SU5 are affected on all six products, regardless of configuration.","fix":"Upgrade to 15SU5 on release 15. Release 14 has no fixed build: migrate to a fixed release (15SU5). No workarounds.","status":"open","published_at":"2026-10-21T17:19:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:07+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:33:07Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to the fixed software release named in Cisco's advisory for your product line; the sources do not list the version.","reach":"unknown","title":"Cisco Unified CM and Unity Connection: input validation flaws, CVSS 8.8","impact":"high","summary":"Cisco's Unified Communications products (Unified CM, IM and Presence, Session Management Edition, Unity Connection, Emergency Responder, Prime Collaboration Deployment) have improper input validation flaws (CWE-20) fixed in a hardening release. The sources do not say what an attacker gets from the specific flaw.","category":"vendor","who_cares":["cisco","unified-cm","unity-connection","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources do not describe the impact","analyst_note":"Find the Cisco security advisory for CVE-2026-76476 to get affected versions, fixed releases, and the exact flaw and preconditions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":3109,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-76476 to get affected versions, fixed releases, and the exact flaw and preconditions.","search":"'-20':81B,229C '-2026':13A,16A,208C '-76476':14A,17A,209C '2026':56B '8.8':11A,84B 'account':104B 'address':198C 'affect':125B 'avail':111B 'cisco':1A,18A,22A,25A,30A,34A,37A,41B,53B,112B,132C,145C,148C,152C,158C,169C,180C 'class':227C 'cm':3A,27A,32A,47B,61B,157C,166C,177C 'collabor':71B,150C 'collaboration':39A 'commit':135C 'common':223C 'communic':154C,160C,171C 'communications':20A 'complex':98B 'comprehens':186C 'concern':214C 'conduct':184C 'confidenti':108B 'configur':128B 'connect':6A,50B,66B,182C 'connection':24A 'cve':12A,15A,207C 'cvss':10A 'cwe':80B,226C,228C 'deploy':72B,151C 'deployment':40A 'discov':201C 'edit':175C 'emerg':67B,146C 'emergency':35A 'engin':142C 'enumer':225C 'exploit':120B 'fix':73B 'flaw':9A,82B,90B 'found':113B 'group':75B,93B,220C 'harden':57B,195C 'high':105B 'host':44B 'im':28A,62B,162C,167C 'impact':106B 'improp':77B,215C 'input':7A,78B,216C 'integr':109B 'intern':115B,187C,200C 'issu':213C 'low':97B,102B 'low-privileg':101B 'manag':155C,161C,172C,174C 'manager':21A 'multipl':199C 'need':99B 'network':95B 'network-reach':94B 'octob':55B 'offer':122B 'ongo':134C 'p':29A,63B,168C 'part':130C 'presenc':163C 'prime':38A,70B,149C 'privileg':103B 'proactiv':137C 'product':140C 'qualiti':141C 'reachabl':96B 'regardless':126B 'relat':211C 'releas':58B,196C 'respond':68B,147C 'responder':36A 'result':192C 'review':189C,191C 'say':116B 'score':85B 'secur':138C,188C 'self':43B 'self-host':42B 'servic':164C 'session':173C 'singl':89B 'sme':33A,64B,178C 'softwar':194C 'team':143C 'track':205C 'unifi':2A,46B,60B,153C,156C,159C,165C,170C,176C 'unified':19A,26A,31A 'unified-cm':45B 'uniti':5A,49B,65B,181C 'unity':23A 'unity-connect':48B 'valid':8A,79B,217C 'vendor':51B 'voic':52B 'vulner':202C,204C 'weak':224C 'workaround':124B 'worst':88B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76476","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76476","severity":null,"published_at":"2026-10-21T17:19:07+00:00","modified_at":"2026-10-22T23:19:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76476:522","url":null,"severity":null,"published_at":"2026-10-23T23:48:30+00:00","modified_at":"2026-10-23T23:48:30+00:00","first_seen_at":"2026-10-23T23:48:30+00:00","fetched_at":"2026-10-23T23:48:30+00:00","note":"Read Cisco advisory cisco-sa-voice-hardening-twgbH9e3: CVE-2026-76476 is the CWE-20 grouping (max CVSS 8.8, PR:L) of internally found bugs; no workaround, not exploited, no PoC; individual flaw details not published. Did not search social: grouped hardening CVE with no named flaw."},{"source":"epss","external_id":"CVE-2026-76476","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76476","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1444,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html","title":"Cisco Unified Communications Products Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}