Live › vulnerability › CVE-2026-76479
Go to dashboardCisco's October 2026 hardening release for Emergency Responder, Prime Collaboration Deployment, Unified CM, IM&P, SME and Unity Connection fixes several internally found path traversal flaws (CWE-22), grouped under one CVE. NVD scores it 7.8 (local, low privileges). Cisco says it found them in internal testing, knows of no exploitation, and offers no workarounds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any on-prem Cisco Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder or Prime Collaboration Deployment on release 14 or on 15 earlier than 15SU5 is affected, whatever its configuration. NVD rates it local with low privileges, so an attacker needs an account on the system. Teams without these Cisco voice products can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Cisco Unified Communications Manager | vendor | 14, 15 before 15SU5 | 15SU5 |
| Cisco Unity Connection | vendor | 14, 15 before 15SU5 | 15SU5 |
| Cisco Emergency Responder | vendor | 14, 15 before 15SU5 | 15SU5 |
show version active on the CLI or the admin page) and compare it with 15SU5; any 14.x is affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.
This page as .md · .json · in your agent: get_signal("CVE-2026-76479")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.