Live › vulnerability › CVE-2026-76478
Go to dashboardCisco grouped internally found improper-access-control flaws (CWE-284, worst case CVSS 8.8) in Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment under one CVE. Cisco gives no per-flaw detail. The CVE record's vector is local, low privilege (AV:L/PR:L), but the advisory states a maximum over several flaws. Affects all configurations; no workarounds. Cisco PSIRT knows of no public announcements or exploitation. Part of a bundle where sibling CVEs score up to 9.8 (CVE-2026-76474 improper auth, network, no privileges), so patch for the whole set.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Unified Communications Manager (Unified CM, IM&P, SME), Unity Connection, Emergency Responder, Prime Collaboration Deployment | vendor | 14 (all SUs), 15 < 15SU5 | 15SU5 |
show version active, or Cisco Unified OS Administration)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
This page as .md · .json · in your agent: get_signal("CVE-2026-76478")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.