---
id: "CVE-2026-76476"
kind: "vulnerability"
aliases: ["CVE-2026-76476"]
title: "Cisco Unified CM and Unity Connection: input validation flaws, CVSS 8.8"
severity: "high"
cvss: 8.8
epss: 0.00338
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Cisco Unified Communications Manager", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Unity Connection", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Unified CM IM&P", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Unified CM SME", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Emergency Responder", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}, {"name": "Cisco Prime Collaboration Deployment", "fixed": ["15SU5"], "affected": "14, 15 < 15SU5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "self-hosted", "unified-cm", "unity-connection", "vendor", "voice"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-21T17:19:07+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76476", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:48:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76476", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Cisco Unified CM and Unity Connection: input validation flaws, CVSS 8.8

Cisco's October 2026 hardening release for Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment fixes a group of improper input validation (CWE-20) flaws. The 8.8 score is the worst single flaw in the group: network-reachable, low complexity, needs a low-privilege account, high impact on confidentiality, integrity and availability. Cisco found them internally, says they are not exploited, and offers no workarounds. Affected regardless of configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Unified Communications Manager affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Unity Connection affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Unified CM IM&P affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Unified CM SME affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Emergency Responder affected 14, 15 < 15SU5 fixed 15SU5
- vendor:Cisco Prime Collaboration Deployment affected 14, 15 < 15SU5 fixed 15SU5

## How to check

Check your product version (Cisco admin UI or CLI 'show version active'). Release 14 (any SU) and 15 before 15SU5 are affected on all six products, regardless of configuration.

## Fix

Upgrade to 15SU5 on release 15. Release 14 has no fixed build: migrate to a fixed release (15SU5). No workarounds.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76476
- 2026-10-23T23:48:30+00:00 analyst — Read Cisco advisory cisco-sa-voice-hardening-twgbH9e3: CVE-2026-76476 is the CWE-20 grouping (max CVSS 8.8, PR:L) of internally found bugs; no workaround, not exploited, no PoC; individual flaw details not published. Did not search social: grouped hardening CVE with no named flaw.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76476

## Documents

- [advisory] Cisco Unified Communications Products Security Hardening Release: October 2026 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp;

The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_