Vulnerability Intelligence Report

Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities

CVE-2026-76476

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.   The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.

No Active Exploit Signals

CVSS Base Score

8.8

HIGH

Exploitability:2.9

Impact Score:5.9

EPSS Probability:0.34%

Executive Threat Verdict

Evaluating...

Evaluating Threat Landscape...

Assessing known weaponization, exploitation telemetry, and federal advisories.

Attack Surface

—

Authentication

—

Weaponization

—

SSVC Action

—

Weaknesses (CWE)

CWE-20 ↗Improper Input Validation

Affected Products & Versions

Vendor	Product	Affected Versions
Cisco	Cisco Emergency Responder	14 (affected), 14SU1 (affected), 14SU2 (affected), 14SU3 (affected), 14SU3a (affected), 15 (affected), 15SU1 (affected), 15SU1a (affected), 14SU4 (affected), 15SU2 (affected), 15SU3 (affected), 14SU5 (affected), 15SU4 (affected), 14SU6 (affected)
Cisco	Cisco Unified Communications Manager	14 (affected), 14SU1 (affected), 14SU2 (affected), 14SU3 (affected), 15 (affected), 15SU1 (affected), 14SU4 (affected), 14SU4a (affected), 15SU1a (affected), 15SU2 (affected), 15.0.1.13010-1 (affected), 15.0.1.13011-1 (affected), 15.0.1.13012-1 (affected), 15.0.1.13013-1 (affected), 15.0.1.13014-1 (affected), 15.0.1.13015-1 (affected), 15.0.1.13016-1 (affected), 15.0.1.13017-1 (affected), 15SU3a (affected), 14SU5 (affected), 15SU4 (affected), 15SU4a (affected), 14SU6 (affected)
Cisco	Cisco Unified Communications Manager IM and Presence Service	14 (affected), 14SU1 (affected), 14SU2 (affected), 14SU2a (affected), 14SU3 (affected), 15 (affected), 15SU1 (affected), 14SU4 (affected), 15SU2 (affected), 15SU3 (affected), 14SU5 (affected), 15SU4 (affected), 14SU6 (affected)
Cisco	Cisco Unity Connection	14 (affected), 14SU1 (affected), 14SU2 (affected), 14SU3 (affected), 14SU3a (affected), 15 (affected), 15SU1 (affected), 14SU4 (affected), 15SU2 (affected), 15SU3 (affected), 14SU5 (affected), 15SU4 (affected), 14SU6 (affected)

Exploitation & Remediation

References & Technical Advisories

NVD Listing ↗ MITRE Listing ↗ GitHub Advisory ↗

No reference links found.

Threat Intelligence Signals

EPSS Score

0.338%

GitHub Advisory

GHSA-pwvw-8g2w-9j7r ↗

CVSS Vector Breakdown

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality

Integrity

Availability

Identity & Timeline

Status	PUBLISHED
Assigning Authority	Cisco Systems, Inc. · Hosted Service · USA
Reserved	2026-08-19T12:02:03
Published	2026-10-21T16:15:26
Last Updated	2026-10-22T23:04:33

MITRE ATT&CK Mapping

Tactics

Techniques

CVE-2026-76476

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

CVE-2026-76476

—

Public Weaponization & Exploit Code Exploit-DB Catalog

Weaknesses (CWE)

Affected Products & Versions

Exploitation & Remediation

References & Technical Advisories

Threat Intelligence Signals

CVSS Vector Breakdown

Identity & Timeline

SSVC Prioritization

MITRE ATT&CK Mapping

Community Chatter & Buzz

Related Intelligence

SHARE INTELLIGENCE WIRE