{"id":"CVE-2026-76478","kind":"vulnerability","aliases":["CVE-2026-76478"],"related":[],"title":"Cisco Unified Communications: improper access control lets attackers bypass restrictions","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.","summary":"Cisco grouped internally found improper-access-control flaws (CWE-284, worst case CVSS 8.8) in Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment under one CVE. Cisco gives no per-flaw detail. The CVE record's vector is local, low privilege (AV:L/PR:L), but the advisory states a maximum over several flaws. Affects all configurations; no workarounds. Cisco PSIRT knows of no public announcements or exploitation. Part of a bundle where sibling CVEs score up to 9.8 (CVE-2026-76474 improper auth, network, no privileges), so patch for the whole set.","severity":"high","cvss":8.8,"epss":0.00113,"exploited":false,"exploited_at":null,"products":[{"name":"Cisco Unified Communications Manager (Unified CM, IM&P, SME), Unity Connection, Emergency Responder, Prime Collaboration Deployment","fixed":["15SU5"],"affected":"14 (all SUs), 15 < 15SU5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco","emergency-responder","infrastructure","self-hosted","unified-cm","unity-connection","voice"],"not_affected_if":["unknown"],"how_to_check":"Check the installed release on each node (admin CLI: 'show version active', or Cisco Unified OS Administration). Release 14 (any SU) is affected; release 15 below 15SU5 is affected. All configurations are vulnerable.","fix":"Upgrade to 15SU5 or later on release 15. Release 14 has no fixed build: migrate to a fixed release (15SU5). No workarounds.","status":"open","published_at":"2026-10-21T17:19:07+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:33:04+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T22:33:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Cisco Unified CM, IM&P, SME, Unity Connection, Emergency Responder or Prime Collaboration Deployment to the fixed release named in the Cisco advisory; the sources do not name the version.","reach":"unknown","title":"Cisco Unified Communications: improper access control lets attackers bypass restrictions","impact":"medium","summary":"Cisco reports improper access control flaws in Unified CM, Unity Connection, Emergency Responder and related voice products, fixed in a hardening release. The sources do not say what an attacker can reach or do, only that the flaws are in the CWE-284 class.","category":"infrastructure","who_cares":["cisco","unified-cm","unity-connection","voice"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; sources only name improper access control","analyst_note":"Find the Cisco security advisory for CVE-2026-76478 to get the affected and fixed releases, the attack vector, and whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000522,"input_tokens":3100,"output_tokens":423,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Cisco security advisory for CVE-2026-76478 to get the affected and fixed releases, the attack vector, and whether authentication is required.","search":"'-2026':12A,15A,134B,226C '-284':58B,246C '-76474':135B '-76478':13A,16A,227C '8.8':62B '9.8':132B 'access':5A,54B,232C 'address':216C 'advisori':101B 'affect':108B 'announc':119B 'attack':8A 'auth':137B 'av':96B 'bundl':125B 'bypass':9A 'case':60B 'cisco':1A,17A,33B,48B,80B,113B,150C,163C,166C,170C,176C,187C,198C 'cm':22A,43B,65B,175C,184C,195C 'collabor':75B,168C 'collaboration':31A 'commit':153C 'common':240C 'communic':3A,172C,178C,189C 'communications':19A 'comprehens':204C 'conduct':202C 'configur':110B 'connect':46B,70B,200C 'connection':27A 'control':6A,55B,233C 'cve':11A,14A,79B,88B,133B,225C 'cves':128B 'cvss':61B 'cwe':57B,243C,245C 'deploy':76B,169C 'deployment':32A 'detail':86B 'discov':219C 'edit':193C 'emerg':35B,71B,164C 'emergency':28A 'emergency-respond':34B 'engin':160C 'enumer':242C 'exploit':121B 'flaw':56B,85B,107B 'found':51B 'give':81B 'group':49B,237C 'harden':213C 'host':40B 'im':23A,66B,180C,185C 'improp':4A,53B,136B,231C 'improper-access-control':52B 'infrastructur':37B 'intern':50B,205C,218C 'issu':234C 'know':115B 'l':98B 'l/pr':97B 'let':7A 'local':93B 'low':94B 'manag':173C,179C,190C,192C 'manager':20A 'maximum':104B 'multipl':217C 'network':138B 'one':78B 'ongo':152C 'p':24A,67B,186C 'part':122B,148C 'patch':142B 'per':84B 'per-flaw':83B 'pillar':244C 'presenc':181C 'prime':30A,74B,167C 'privileg':95B,140B 'proactiv':155C 'product':158C 'psirt':114B 'public':118B 'qualiti':159C 'record':89B 'relat':229C 'releas':214C 'respond':36B,72B,165C 'responder':29A 'restrict':10A 'result':210C 'review':207C,209C 'score':129B 'secur':156C,206C 'self':39B 'self-host':38B 'servic':182C 'session':191C 'set':146B 'sever':106B 'sibl':127B 'sme':25A,68B,196C 'softwar':212C 'state':102B 'team':161C 'track':223C 'unifi':2A,42B,64B,171C,174C,177C,183C,188C,194C 'unified':18A,21A 'unified-cm':41B 'uniti':45B,69B,199C 'unity':26A 'unity-connect':44B 'vector':91B 'voic':47B 'vulner':220C,222C 'weak':241C 'whole':145B 'workaround':112B 'worst':59B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76478","severity":null,"published_at":"2026-10-21T17:19:07+00:00","modified_at":"2026-10-22T23:19:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76478:520","url":null,"severity":null,"published_at":"2026-10-23T23:47:32+00:00","modified_at":"2026-10-23T23:47:32+00:00","first_seen_at":"2026-10-23T23:47:32+00:00","fetched_at":"2026-10-23T23:47:32+00:00","note":"Read Cisco hardening advisory cisco-sa-voice-hardening-twgbH9e3: CVE-2026-76478 is the CWE-284 bucket (max CVSS 8.8, vector AV:L/PR:L per CVE record) of a grouped release; not exploited per Cisco PSIRT; no workarounds; fix 15SU5, 14 must migrate. Individual flaw details not published; social search not done."},{"source":"epss","external_id":"CVE-2026-76478","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76478","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1444,"url":"https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html","title":"Cisco Unified Communications Products Security Hardening Release: October 2026","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2171,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76478","title":"CVE Record: CVE-2026-76478","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}