---
id: "CVE-2026-76478"
kind: "vulnerability"
aliases: ["CVE-2026-76478"]
title: "Cisco Unified Communications: improper access control lets attackers bypass restrictions"
severity: "high"
cvss: 8.8
epss: 0.00113
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Unified Communications Manager (Unified CM, IM&P, SME), Unity Connection, Emergency Responder, Prime Collaboration Deployment", "fixed": ["15SU5"], "affected": "14 (all SUs), 15 < 15SU5", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "emergency-responder", "infrastructure", "self-hosted", "unified-cm", "unity-connection", "voice"]
not_affected_if: ["unknown"]
published_at: "2026-10-21T17:19:07+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76478", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:47:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76478", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Cisco Unified Communications: improper access control lets attackers bypass restrictions

Cisco grouped internally found improper-access-control flaws (CWE-284, worst case CVSS 8.8) in Unified CM, IM&P, SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment under one CVE. Cisco gives no per-flaw detail. The CVE record's vector is local, low privilege (AV:L/PR:L), but the advisory states a maximum over several flaws. Affects all configurations; no workarounds. Cisco PSIRT knows of no public announcements or exploitation. Part of a bundle where sibling CVEs score up to 9.8 (CVE-2026-76474 improper auth, network, no privileges), so patch for the whole set.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Unified Communications Manager (Unified CM, IM&P, SME), Unity Connection, Emergency Responder, Prime Collaboration Deployment affected 14 (all SUs), 15 < 15SU5 fixed 15SU5

## How to check

Check the installed release on each node (admin CLI: 'show version active', or Cisco Unified OS Administration). Release 14 (any SU) is affected; release 15 below 15SU5 is affected. All configurations are vulnerable.

## Fix

Upgrade to 15SU5 or later on release 15. Release 14 has no fixed build: migrate to a fixed release (15SU5). No workarounds.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76478
- 2026-10-23T23:47:32+00:00 analyst — Read Cisco hardening advisory cisco-sa-voice-hardening-twgbH9e3: CVE-2026-76478 is the CWE-284 bucket (max CVSS 8.8, vector AV:L/PR:L per CVE record) of a grouped release; not exploited per Cisco PSIRT; no workarounds; fix 15SU5, 14 must migrate. Individual flaw details not published; social search not done.
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76478

## Documents

- [advisory] Cisco Unified Communications Products Security Hardening Release: October 2026 https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-voice-hardening-twgbH9e3.html
- [describes] CVE Record: CVE-2026-76478 https://www.cve.org/CVERecord?id=CVE-2026-76478

## From the sources

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_